How to Find the Physical Address of a Router by BSSID Using geowifi

Every time a smartphone looks for a familiar network, it scans the radio waves and sees dozens of routers around. Large companies like Google and Apple have been collecting this data paired with GPS coordinates for years to determine device locations in dense urban areas without waiting for satellites.

As a result, a giant map of all home and office access points has formed around us. If you get your hands on a router's MAC address (BSSID) or a rare network name (SSID), you can pull its physical coordinates in a couple of seconds.

The geowifi utility takes care of this routine. Instead of manually checking a dozen scattered services, it sends queries to all available Wi-Fi geolocation databases at once.

Why combine all databases into one script

Each database collects coordinates in its own way. The Wigle service relies on enthusiasts who drive around cities with scanners enabled. Apple's database is populated by iOS smartphones, Google's by Android devices.

If you search for a point in only one place, there's a high chance of getting nothing. Access points move, appear in new developments, or disappear from public lists. The geowifi utility queries open and semi-closed sources:

• Wigle
• Apple Geolocation Services
• Google Geolocation API
• Mylnikov (mylnikov.org)
• WifiDB
• Combain
• Freifunk Carte

An interesting detail: queries to Apple here work without registration and paid subscriptions, using an implementation inspired by the iSniff-GPS project. For Google and Wigle, you'll need API keys, but they have free limits that are sufficient for everyday tasks.

Quick start and setup

The project is written in Python. You can deploy it locally in a virtual environment or via a Docker container.

For local work, you'll need git and Python 3:

git clone https://github.com/GONZOsint/geowifi
cd ./geowifi/
virtualenv geowifi
source geowifi/bin/activate
python3 -m pip install -r requirements.txt

If you don't want to deal with the Python environment, build the container:

docker build -t geowifi:latest .

API configuration

In the gw_utils directory there's a config.yaml file. This is where you configure access tokens:

wigle_auth: "your_encoded_token"
google_api: "your_google_api_key"
combain_api: "your_combain_key"
no-ssl-verify: false

For basic work with open databases and Apple, keys are optional, but with them the percentage of found points is noticeably higher.

How to search for coordinates

The utility accepts a network identifier and a search type flag: by BSSID (MAC address) or SSID (network name).

Search by router MAC address:

python3 geowifi.py -s bssid C8:D7:19:XX:XX:XX

Search by network name:

python3 geowifi.py -s ssid "MyCoffeeShop_Free"

By default, the program generates an HTML map with markers from different data providers. Different databases may return coordinates with a slight spread, and a visual map helps understand the actual coverage area or the exact building.

If the output is needed for subsequent automation or passing to another script, just add the -o json parameter:

[
  {
    "module": "google", 
    "bssid": "C8:XX:XX:XX:5E:45", 
    "latitude": 33.571844, 
    "longitude": -112.0495897
  }, 
  {
    "module": "vendor_check", 
    "vendor": "Cisco-Linksys, LLC"
  }, 
  {
    "module": "apple", 
    "bssid": "C8:XX:XX:XX:5E:45", 
    "latitude": 33.57198715, 
    "longitude": -112.0495812
  }, 
  {
    "module": "wigle", 
    "bssid": "C8:XX:XX:XX:5E:45", 
    "ssid": "Vertigo", 
    "latitude": 33.60998154, 
    "longitude": -112.0495922
  }
]

Besides coordinates, the utility immediately identifies the network equipment manufacturer by the OUI prefix of the MAC address.

Where this comes in handy

The tool was created for OSINT and network reconnaissance tasks, but it's also useful in related areas:

1. Forensics and network dump analysis. If the laptop under investigation has retained probe requests or a history of Wi-Fi network connections, you can reconstruct the device's approximate movement route by BSSID.
2. Security and privacy audit. It's useful to check your home or corporate router. Often you find that a router moved from an apartment to a country house still shows up at the old address in Google or Apple databases.
3. IoT device geolocation. When a device only reports the list of visible access points, the script converts this list into understandable geographic coordinates without using a GPS module.

Conclusion

geowifi is a compact, practical tool that solves one specific task without unnecessary complexity. The code is simple, dependencies are standard, and the logic is transparent. If you do OSINT investigations, analyze wireless traffic dumps, or simply wonder how much geodata leaks through Wi-Fi routers, add this utility to your toolkit.