Wi-Fi MAC Randomization Behavior Analysis

This project investigates how modern smartphones implement MAC address randomization in Wi-Fi probe requests. Using packet sniffing tools like Wireshark, the behavior of an iPhone 14 Pro Max and a Samsung Galaxy A36 was analyzed under various device states including Wi-Fi, screen, and power-saving configurations.

Objective

To compare the frequency and consistency of randomized MAC addresses in Wi-Fi probe requests between two smartphones, under multiple operational scenarios, and to evaluate the effectiveness of privacy-preserving features.

---

Experimental Setup

• Devices Tested:
  • iPhone 14 Pro Max
  • Samsung Galaxy A36
• Sniffing Tool: Wireshark (on ASUS VivoBook laptop)
• Wi-Fi Adapter: Capable of monitor mode
• Channel: Wi-Fi Channel 2 (20 MHz)
• Proximity: Phones placed ~20cm from receiver
• Capture Duration: 4 hours (20 mins per scenario)

---

Scenarios Evaluated

Each phone was tested under 12 combinations of:

• Wi-Fi: ON / OFF
• Screen: ON / OFF
• Power Saving: ON / OFF

Example scenarios:

• Wi-Fi ON, Screen ON, Power Saving OFF
• Wi-Fi OFF, Screen ON, Power Saving OFF
• Wi-Fi ON, Screen OFF, Power Saving ON
• etc.

---

🎯 Key Findings

• The iPhone 14 Pro Max showed more aggressive and consistent MAC address randomization.
• The Samsung Galaxy A36 exhibited more context-sensitive randomization, balancing privacy with power efficiency.
• Probe requests dropped significantly when Wi-Fi or screen was off, and disappeared entirely under Wi-Fi OFF + Power Saving ON.

---

🛠 Tools & Techniques

• Wireshark Filters:
  • wlan.fc.type_subtype == 0x04 (Probe Requests)
  • wlan_radio.signal_dbm >= -85 (Strong signal)
• Data Visualizations: Frequency tables and scenario-based MAC address patterns