I logged into my Palo Alto Networks firewall and checked the object I had created for this iPad. With that I had the IP address and MAC address. Out of curiosity, I checked the traffic log to see when it was last online. Lo-and-behold, the thing is online...today...right now!
At this point, I'm pretty stoked. This means the iPad is still in the house somewhere! (and super-impressed that it's still checking-in on wifi after weeks of being missing). Now, to find it.
I fired up Backtrack Linux with with an Alfa USB 802.11b/g adapter - but it couldn't see the iPad's MAC address. The wireless controller reported that the iPad was connected to an AP using 802.11a/5ghz. Unfortunately, the Alfa USB adapter only supports 802.11b/g.
I shut down the 5Ghz radios on the APs, which forced the iPad to connect to the b/g radio instead. Now the Alfa wifi adapter could see the iPad's wireless MAC address! From here, it was a game of hide-and-seek. I started upstairs and worked my way around the house, waving the wifi adapter around while watching the "power levels" reported by airmon-ng. I eventually worked my way to the basement where I found stronger power levels. After a loop around the basement, I came to a point where the power levels were screaming at me. Sure enough, the iPad was right there, hiding in plain sight.
Time to put "find my iphone" on this iPad so we don't have to play this game again. Maybe I'll setup triangulation on the wifi APs too. :)
