Mobile Information Systems

Mobile Information Systems / 2017 / Article

Research Article | Open Access

Volume 2017 |Article ID 7821585 |

Lin Sun, Sinong Chen, Zengwei Zheng, Longyang Xu, "Mobile Device Passive Localization Based on IEEE 802.11 Probe Request Frames", Mobile Information Systems, vol. 2017, Article ID 7821585, 10 pages, 2017.

Mobile Device Passive Localization Based on IEEE 802.11 Probe Request Frames

Academic Editor: L. J. García Villalba
Received02 Apr 2017
Revised28 Apr 2017
Accepted08 May 2017
Published19 Jun 2017


This paper presents a novel passive mobile device localization mode based on IEEE 802.11 Probe Request frames. In this approach, the listener can discover mobile devices by receiving the Probe Request frames and localize them on his walking path. The unique location of the mobile device is estimated on a geometric diagram and right-angled walking path. In model equations, site-related parameter, that is, path loss exponent, is eliminated to make the approach site-independent. To implement unique localization, the right-angled walking path is designed and the optimal location is estimated from the optional points. The performance of our method has been evaluated inside the room, outside the room, and in outdoor scenarios. Three kinds of walking paths, for example, horizontal, vertical, and slanted, are also tested.

1. Introduction

Wi-Fi is a major component for communication in mobile devices, for example, phone and tablet. Researchers take advantage of Wi-Fi signal to build indoor localization system [1, 2], life pattern analysis [3], human activity recognition [4], and so on. In indoor localization system, a mobile app has been installed in a mobile phone, reads Wi-Fi RSSI value from Wi-Fi APs, sends RSSI fingerprint, and queries location from the RSSI fingerprint database. The user himself can know his accurate position inside a building, as shown in Figure 1. This kind of localization mode is called active. In this paper, we present a novel passive mobile device localization mode based on IEEE 802.11 Probe Request frames without Wi-Fi APs and reference points. The listener can discover the mobile device by receiving the Probe Request frames and localize the position of the mobile device. The listener only equipped with his mobile can secretly know where another mobile holder is, as shown in Figure 2. He can also infer the MAC address of the holder’s mobile device or look for the mobile holder with a specific MAC address. This kind of passive localization is a great challenge because there are no reference points or radio map deployed in advance. Another problem is that path loss exponent, which is an important parameter in radio propagation model, varies with different environments.

There are two basic modes in WLAN localization problems. One is to know where I am and the other is to know where you are. The former is called active and the latter is called passive [5].

Active localization methods are always fingerprint-based and nonfingerprint-based. In fingerprint-based localization [2, 6], Wi-Fi APs should be deployed in advance and a fingerprint database is created to store signal feature values at each spatial coordinate. Nonfingerprint-based solutions use geometric properties of triangles to estimate the target location without development of a radio map [7]. Common metrics include received signal strength (RSS) [1], time difference of arrival (TDOA) [8], time of arrival (TOA) [9], and angle of arrival (AOA) [10]. Signals from two or three reference points must be made available to these metrics. The advantage of signal strength is that it is easy to implement; however, the parameters in radio model are site-specific. For example, it was needed to estimate path loss exponent (PLE) and other factors from the training data by regression model [1]. Time and angle of an arrival signal would suffer from multipath effect and line-of-sight (LOS) paths between the transmitter and receiver are usually obstructed by walls in indoor environments.

In passive mode, Youssef et al. [11, 12] presented a device-free passive (DfP) localization method. The concept relied on the fact that RF signals were affected by changes in the environment. The monitoring stations continuously recorded signal strength or time-of-flight, which were used to construct a radio map to present the signal changes with entities movement and their locations. Like fingerprint-based localization, this method needs Wi-Fi AP and has to build a radio map in advance. Another technology is Radio Tomographic Imaging (RTI). Wilson and Patwari [13] presented a linear model for using RSS measurements to obtain images of moving objects in wireless networks.

Radar-based techniques also do not require the tracked entity to carry an electronic device. Ultra-wideband (UWB) radar systems provided through-wall imaging methods [14, 15] to detect human activity [16] and track walking [17]. These systems are accurate, but very complex. Lin and Ling [18] demonstrated an alternate development of a Doppler radar with two-element receiving array for tracking human movements in indoor surveillance applications. Multiple-input multiple-output (MIMO) radar is another emerging field that takes advantage of multiple transmitters and receivers to locate objects within a spatial area [19].

Table 1 shows the comparison of different localization methods based on radio signal in the requirements of AP or wireless node, reference point, PLE estimation, radio map, and special hardware.

AP or wireless nodeReference pointPLE estimationRadio mapSpecial hardware

RSS [1]×××
TDOA [8], TOA [9], AOA [10]×××
DfP [11, 12], RTI [13]×××
Radar-based [1419]×××
Our method×××××

Some researches passively monitored Wi-Fi Probe Request frame to study the device owners. Scheuner et al. [20] developed a passive Wi-Fi tracking system Probe. It processed and visualized Wi-Fi traces and supported online analysis. The cases of room utilization, person tracking, and device statistics were demonstrated. Cunche et al. [21] exploited Wi-Fi fingerprints to infer social links between devices owners.

3. Passive Mobile Device Localization Mode

3.1. Probe Request Frame Review

In Wi-Fi technology, a mobile station periodically sends Probe Request frames to discover existing 802.11 networks within its proximity. The Probe Request is sent from the mobile station to the destination layer-2 address ff:ff:ff:ff:ff:ff. The listener with a Wi-Fi network card, which supports monitor mode, can capture the Probe Request frames [22].

Another piece of information required in our approach is received signal strength indication (RSSI), which can be found in radiotap header. Figure 3 shows the example of a 802.11g radiotap header and Probe Request frame header received from a Xiaomi mobile phone by Wireshark, a network protocol analyzer. “SSI signal” represents RSSI in Wireshark.

3.2. Position Estimation

Log-distance path loss model [23] is a radio propagation model that predicates the path loss in indoor or indoor-to-outdoor environments, written as follows:where is the length of the path from the transmitter to the receiver and is the reference distance (for example, meter).

is path loss of distance , where is the transmitted power in dBm and is the received power in dBm. is path loss exponent, which is a measure of the influence of obstacles like partitions, walls, and doors.

Let and be equal in path loss measurements; we getwhere stands for a RSSI value in radiotap header received by the passive listener, which is 1 meter from the mobile device.

Figure 4 shows geometric diagram of passive position estimation. The listener walks from point to point and then point . , , and are RSSI values received on points , , and , respectively. , , and are the distances between points , , and and Wi-Fi device , respectively. According to (2), we can write is eliminated by dividing (3) by (4) and letthen we getSimilarly, we divide (4) by (5) and letwe getUsing the Law of Cosines in a triangle, , , , , , , , and in Figure 4 should satisfy the following equations: and can be replaced by using (7) and (9); (10) becomeIn (11), and are known. , , and are walking distances. , , and are three unknown variables needed to be solved. These nonlinear equations can be solved by Newton’s method with Jacobian matrix [24, 25]. Newton’s method will converge while the initial guess is sufficiently close to the solution [26]. Fortunately, we can know where the solution lies. The initial guess of can be estimated by (2) assuming since [27], and start at because .

3.3. Least-Squares Estimation for Four Points in Walking Path

Four-point walking path is also addressed in this section. The log-distance equation in and triangle equations can be written as follows:and the Law of Cosines in ΔCWD and ΔBWD, shown in Figure 4, is also added to (10),Let and replacing by in (13), we getIn (14), there are five equations and four unknown variables, , , , and . Least-squares minimization of the residual of a set of nonlinear equations is solved by Levenberg-Marquardt method. Moré [28] presented a version of the Levenberg-Marquardt algorithm, implemented in MINPACK [29], with strong convergence properties. Also, the good initial guess yields the desired result.

3.4. Uniqueness of Localization

The mobile device has two optional points, which are symmetric with respect to the walking path. Here we present a method to select unique location from the candidates. The scheme is to turn a corner in walking path, for example, in Figure 5. will give two candidates of the location and will also give other two candidates of the location . Assume and are on the side of the ground truth, shown in Figure 5, the distance between and is shorter than other combinations, that is, , , and . So we define optimal location estimation where distance is the minimum between and ,The center point between and , that is, , is considered as the unique location of the mobile device. In experiments, we will give the results of unique localization in detail.

4. Experiments

4.1. Settings

To evaluate our passive localization approach, three types of scenarios are designed:(i)Inside the room (Figure 6): this is near distance situation tested in the room.(ii)Outside the room (Figure 7): this is dividing-wall situation when the listener is outside the room.(iii)Outdoor (Figure 8): this is middle distance situation tested in the square.

In Figures 6, 7, and 8, the letters are the placements of mobile devices and numbers 1–12 are the points in the walking path of the listener. There are three kinds of walking paths, horizontal, vertical, and slanted. Table 2 shows the details.

Inside the roomOutside the roomOutdoor




Examples of the listeners include the devices based on Nokia Maemo, Android, or MAC OS. Here a MacBook is used as the listener. Three mobile devices, for example, iPad, Nexus, and Xiaomi Note, are used to be discovered and passively localized. The RSSI value on each point of the path is the average of several Probe Request frames.

4.2. Position Evaluation Results

To evaluate passive positioning performance, the bias rate is defined as follows:where is estimated distances, for example, , , and , which have been calculated in (10). is the ground truth for the distances , , and .

We evaluate 222 samples including 72 inside the room, 126 outside the room, and 24 outdoor in the experiment. Tables 3, 4, and 5 show the average bias rate of distances , , and in different scenarios and walking paths. The three-point paths have been selected from in outside the room setting and so on. From the results, there is no walking path which is obviously better than others among horizontal, vertical, and slanted paths. Fortunately, the result of outside the room is not worse than those of inside the room and outdoor, although the listener and the mobile device are obstructed by wall.

Apple iPadGoogle NexusXiaomi Note


Apple iPadGoogle NexusXiaomi Note


Apple iPadGoogle NexusXiaomiNote


We have also computed the bias between the estimated location point and the ground truth point , shown in Figure 4. Figure 9 shows the cumulative distribution (CDF) of localization error. 75% errors are less than 2 meters inside the room, 4 meters outside the room, and outdoor. Figure 10 shows localization error in three walking styles including 72 horizontal, 90 vertical, and 60 slanted samples. Our method gets similar performance on different walking styles.

Figure 11 shows the comparison of different mobiles. are about 1.6, 2.5, and 3.5 meters averagely inside the room, outside the room, and outdoor, respectively. The localization accuracy of Apple iPad and Xiaomi note is similar, but Google Nexus is the worst.

4.3. Four-Point versus Three-Point Distance Estimation

Localization performance using four points in walking path is also tested by (14). Examples of four-point distance estimation is , and those of three-point distance estimation are , , , and in outside the room setting. Figure 12 shows the bias result of four-point and three-point estimation. There is no obvious improvement on four-point paths, but the performance could be robust.

4.4. Performance of Unique Localization on Right-Angled Paths

The performance of unique localization on right-angled paths has been tested inside the room, outside the room, and outdoor. The right-angled paths, for example, in Figure 6 and in Figure 7, are selected.

Figure 13 shows the results of the unique localization method presented in Section 3.4. Diamond symbols ⧫ in (a), (b), and (c) denote the ground truth of mobile device location. Colorful rectangles indicate the bounding path boxes in Figures 6, 7, and 8. The symbols and are two optional locations with respect to the walking path, where the optimal overlap , defined in (15), is represented as . The symmetric optional locations along the walking path are labeled in the same color. From the results, we can see that all optimal locations are correct. The localization performance on the green walk path, which is far away from ⧫, is lower.

4.5. Path Loss Exponent Computing

After solving (11), path loss exponent has also been computed by (4) and boxplots of the distribution inside the room, outside the room, and outdoor are shown in Figure 14. The empirical value of path loss exponent is about 2 in free space and 4–6 in buildings [27]. In our experiments, inside the room and outdoor environments are like free space without obstacles while outside the room setting is a dividing-wall scenario in buildings. Figure 14 shows that path loss exponent estimation results in our method are quite similar to the empirical value of experimental settings.

4.6. Discussion

is RSSI value received by the listener, which is 1 meter from a mobile Wi-Fi device. We measured parameter of iPad, Nexus, and Xiaomi Note, as shown in Table 6.

Apple iPadGoogle NexusXioamiNote

 dBm dBm dBm

value might be a little different in various mobile devices of the same brand. Here we discuss the effect on distance estimation when varies with different mobile devices. From (2), we get the change of with respect to ,Then, the relation between the change rate of and the change of is

Path loss exponent is about 2-3 in free space and 4–6 in buildings [27]. Figure 15 shows the change rate caused by the change of when and . From the results, we can see that are less than 10% and 19% when the deviation of is no more than 2 dBm in buildings and free space, respectively.

4.7. Movement Estimation Error Discussion

There might be an error in the estimation of movement distances or in Figure 4. The localization error caused by movement estimation error inside and outside the room is shown in Figures 16 and 17, respectively. The testing mobile is Google Nexus7. The axes and in the figures are and in Figure 4, respectively. The colorful pixels represent the estimation error to the ground truth of the mobile.

The path and mobile location of Figure 6 are used for inside the room testing. The ground truth of and is 2 meters. The estimation of and is supposed to be from 1 meter to 3 meters. The path and mobile location of Figure 7 are used for outside the room testing. The ground truth of and is 2 meters. The estimation of and is supposed to be from 1 meter to 3 meters.

In inside the room setting, 0.5 meters of walk estimation error will cause about 0.4 meters of mobile localization error. In outside the room setting, the estimation error of (i.e., in Figure 7) produces less localization error than that of (i.e., in Figure 7) because path is closer to the mobile location than path . The localization error increases while and increase or decrease simultaneously. However, a small increase of the localization error is produced when one distance increases and the other decreases; that is, the sum of and is the same. The estimation error of point , which is less than 0.5 meters, will cause small localization error when points and are fixed. The reason is that points and are key points to form the triangle .

5. Conclusion

In this paper, we present a novel passive mobile localization mode based on IEEE 802.11 Probe Request frames without Wi-Fi APs and reference points. In this approach, a geometric diagram is designed to estimate the location of mobile device. Using this approach, nearby mobile devices can be discovered on the listener’s walking path. To solve the model equations, path loss exponent, which is a site-related parameter, is eliminated. Therefore, our method is site-independent and does not need to train the parameter which is related to the environments. The experimental results show that the errors of mobile device location are lower than 2 meters and 3.5 meters in indoor and outdoor scenarios, respectively. The performance outside the room, inside the room, and outdoor is similar, although path loss exponents are different in these three kinds of scenarios. The unique localization method on right-angled paths is successful although the walking path is far away from the mobile device. The estimation results of path loss exponents are quite similar to the empirical value of experimental settings. The effect of parameter is less than 20% when its deviation is no more than 2 dBm. We also analyze the localization error caused by movement estimation error inside and outside the room. The localization error is less than 0.4 meters when 0.5 meters error occurs in walk estimation generally; however, a small error increases when is fixed.

Conflicts of Interest

The authors declare that there are no conflicts of interest regarding the publication of this paper.


This work was supported by Hangzhou Science and Technology Development Plan Project (no. 20150432B17) and Zhejiang Provincial Natural Science Foundation of China (under Grant no. LY17F020008).


  1. N. Chang, R. Rashidzadeh, and M. Ahmadi, “Robust indoor positioning using differential Wi-Fi access points,” IEEE Transactions on Consumer Electronics, vol. 56, no. 3, pp. 1860–1867, 2010. View at: Publisher Site | Google Scholar
  2. Z. Yang, C. Wu, and Y. Liu, “Locating in fingerprint space: wireless indoor localization with little human intervention,” in Proceedings of the 18th Annual International Conference on Mobile Computing and Networking (Mobicom '12), pp. 269–280, August 2012. View at: Publisher Site | Google Scholar
  3. J. Rekimoto, T. Miyaki, and T. Ishizawa, “LifeTag: WiFi-based continuous location logging for life pattern analysis[C]//LoCA,” 2007, 2007: 35-49. View at: Google Scholar
  4. A. Alvarez-Alvarez, J. M. Alonso, and G. Trivino, “Human activity recognition in indoor environments by means of fusing information extracted from intensity of WiFi signal and accelerations,” Information Sciences, vol. 233, pp. 162–182, 2013. View at: Publisher Site | Google Scholar
  5. G. Deak, K. Curran, and J. Condell, “A survey of active and passive indoor localisation systems,” Computer Communications, vol. 35, no. 16, pp. 1939–1954, 2012. View at: Publisher Site | Google Scholar
  6. A. Haeberlen, E. Flannery, A. M. Ladd et al., “Practical robust localization over large-scale 802.11 wireless networks,” in Proceedings of the 10th Annual International Conference on Mobile Computing and Networking (MobiCom '04), pp. 70–84, ACM, Philadelphia, Pa, USA, October 2004. View at: Publisher Site | Google Scholar
  7. H. Liu, H. Darabi, P. Banerjee, and J. Liu, “Survey of wireless indoor positioning techniques and systems,” IEEE Transactions on Systems, Man and Cybernetics, vol. 37, no. 6, pp. 1067–1080, 2007, Part C (Applications and Reviews). View at: Publisher Site | Google Scholar
  8. X. Li, K. Pahlavan, M. Latva-aho et al., “Comparison of indoor geolocation methods in DSSS and OFDM wireless LAN systems,” in Proceedings of the 52nd Vehicular Technology Conference (IEEE-VTS Fall VTC 2000), 6, pp. 3015–3020, IEEE, 2000. View at: Google Scholar
  9. S. A. Golden and S. S. Bateman, “Sensor measurements for Wi-Fi location with emphasis on time-of-arrival ranging,” IEEE Transactions on Mobile Computing, vol. 6, no. 10, 2007. View at: Publisher Site | Google Scholar
  10. D. Niculescu and B. Nath, “Ad hoc positioning system (APS) using AOA,” in Proceedings of the 22nd Annual Joint Conference on the IEEE Computer and Communications Societies (INFOCOM '03), vol. 3, pp. 1734–1743, IEEE, San Francisco, CA, USA, April 2003, INFOCOM 2003. View at: Publisher Site | Google Scholar
  11. M. Youssef, M. Mah, and A. Agrawala, “Challenges: device-free passive localization for wireless environments,” in Proceedings of the 13th Annual ACM International Conference on Mobile Computing and Networking (MobiCom'07), pp. 222–229, ACM, Montréal, Québec, Canada, September 2007. View at: Publisher Site | Google Scholar
  12. M. Seifeldin, A. Saeed, A. E. Kosba, A. El-Keyi, and M. Youssef, “Nuzzer: a large-scale device-free passive localization system for wireless environments,” IEEE Transactions on Mobile Computing, vol. 12, no. 7, pp. 1321–1334, 2013. View at: Publisher Site | Google Scholar
  13. J. Wilson and N. Patwari, “Radio tomographic imaging with wireless networks,” IEEE Transactions on Mobile Computing, vol. 9, no. 5, pp. 621–632, 2010. View at: Publisher Site | Google Scholar
  14. Y. Yunqiang and A. E. Fathy, “See-through-wall imaging using Ultra Wideband short-pulse radar system,” in Proceedings of the 2005 IEEE Antennas and Propagation Society International Symposium and USNC/URSI Meeting, 3, pp. 334–337, IEEE, Washington, DC, USA, July 2005. View at: Publisher Site | Google Scholar
  15. A. R. Hunt, “A wideband imaging radar for through-the-wall surveillance,” in Defense and Security, pp. 590–596, International Society for Optics and Photonics, 2004. View at: Google Scholar
  16. C.-P. Lai and R. M. Narayanan, “Through-wall imaging and characterization of human activity using ultrawideband (UWB) random noise radar,” in Defense and Security, pp. 186–195, International Society for Optics and Photonics, 2005. View at: Publisher Site | Google Scholar
  17. P. Van Dorp and F. C. A. Groen, “Human walking estimation with radar,” IEE Proceedings-Radar, Sonar and Navigation, vol. 150, no. 5, pp. 356–365, 2003. View at: Google Scholar
  18. A. Lin and H. Ling, “Doppler and direction-of-arrival (DDOA) radar for multiple-mover sensing,” IEEE Transactions on Aerospace and Electronic Systems, vol. 43, no. 4, pp. 1496–1509, 2007. View at: Publisher Site | Google Scholar
  19. A. M. Haimovich, R. S. Blum, and L. J. Cimini, “MIMO radar with widely separated antennas,” IEEE Signal Processing Magazine, vol. 25, no. 1, pp. 116–129, 2008. View at: Publisher Site | Google Scholar
  20. J. Scheuner, G. Mazlami, D. Schöni et al., “Probr - a generic and passive WiFi tracking system,” in Proceedings of the 2016 IEEE 41st Conference on Local Computer Networks (LCN), pp. 495–502, IEEE, Dubai, United Arab Emirates, November 2016. View at: Publisher Site | Google Scholar
  21. M. Cunche, M.-A. Kaafar, and R. Boreli, “Linking wireless devices using information contained in Wi-Fi probe requests,” Pervasive and Mobile Computing, vol. 11, pp. 56–69, 2014. View at: Publisher Site | Google Scholar
  22. M. Cunche, “I know your MAC address: targeted tracking of individual using Wi-Fi,” Journal of Computer Virology and Hacking Techniques, vol. 10, no. 4, pp. 219–227, 2014. View at: Publisher Site | Google Scholar
  23. T. S. Rappaport, Wireless Communications: Principles And Practice[M], Prentice Hall PTR, New Jersey, 1996.
  24. A. H. Sherman, “On Newton-iterative methods for the solution of systems of nonlinear equations,” SIAM Journal on Numerical Analysis, vol. 15, no. 4, pp. 755–771, 1978. View at: Publisher Site | Google Scholar | MathSciNet
  25. C. T. Kelley, Solving Nonlinear Equations with Newton's Method, Society for Industrial and Applied Mathematics, 2003. View at: MathSciNet
  26. G. K. Smyth, “Optimization and nonlinear equations,” in Wiley StatsRef: Statistics Reference Online, 1997. View at: Google Scholar
  27. C. Phillips, D. Sicker, and D. Grunwald, “A survey of wireless path loss prediction and coverage mapping methods,” IEEE Communications Surveys & Tutorials, vol. 15, no. 1, pp. 255–270, 2013. View at: Publisher Site | Google Scholar
  28. J. J. Moré, “The levenberg-marquardt algorithm: implementation and theory,” in Numerical Analysis, pp. 105–116, Springer, Berlin, Heidelberg, Germany, 1978. View at: Google Scholar | MathSciNet
  29. J. J. Moré, B. S. Garbow, and K. E. Hillstrom, “User guide for MINPACK-1[R],” Tech. Rep., 1980, CM-P00068642. View at: Google Scholar

Copyright © 2017 Lin Sun et al. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

More related articles

 PDF Download Citation Citation
 Download other formatsMore
 Order printed copiesOrder

Related articles

Article of the Year Award: Outstanding research contributions of 2020, as selected by our Chief Editors. Read the winning articles.