Sniffing my DJI Phantom


One of my co-workers, Linhart, hooked up with another coworker on the drone forum and bought a 3 pack of DJI phantoms. Linhart desired to keep only one of them. He offered me my pick of the litter and I chose the Phantom 2 vision all the way to the right in the 3 pack picture below. I spent 2 frustrating hours trying to setup the camera to work with my phone this morning. My efforts based on the DJI directions for camera setup and binding. Kev failed miserable using the DJI directions. Kev never gives up, so I wrote my own directions. My 20-minute rule dictates if it took me longer than 20 minutes to solve a problem, and the information is not under NDA, it gets published

Sniffing the DJI Phantom Camera

The DJI controller has a WI-FI extender mounted on it acting between your phone and the camera on the drone. The camera on the drone has a Wi-FI access point the extender connects to. The Binding process utilizes a QR code DJI printed only on the original box for some drone models. In my research it looks like they have the QR code on the drone in current models, so my issue only applies to older models. The Binding software allows for a missing QR code by providing a box you use enter the MAC address of the camera into. Sad face; the MAC is not printed on the camera anywhere, and second had drone I did not have the box. Here is what I did to find the MAC address the missing QR code would have told me. :

  1. Math told me the camera has WI-FI so I know the MAC can be sniffed one way or another. My guess was the cameras has a full access point on board. This is important because it means you can use Free tools to find the MAC address. Download and install the free home version of the AcrylicWiFi scanner- https://www.acrylicwifi.com/en/wlan-software/wlan-scanner-acrylic-wifi-free/download-wifi-scanner-windows/
  2. Launch the scanner as administrator – depending how you have windows nanny mode setup.
  3. Turn on the drone and camera in Wi-Fi mode without turning on the extender or controller. We want to be sure the camera is broadcasting it’s hidden SSID, and limit the things you are scanning to make sure you can find the right number.
  4. DJI Phantom owns their own MAC address prefix http://coffer.com/mac_find/?string=60601f making ity simple to see what MAC is associated with their products. In the scanner screen look for things starting with 60:60:1F:XX:XX:XX. You should see one in the list if you only have the drone on. That MAC will be the address you need to bind your drone camera to the extender. See below screen shot of my scan.

  1. In my case I entered 00 72 FC into the MAC address field of the Bind thing in the DJI software. Waited a few seconds and my camera was bound and working.

A few pictures because I like to end all posts with pictures

First picture taken with the camera on the drone – our house from about 100 feet in the air

DJI Phantom 2 Vision with no QR code on the bottom – sad face

HappyMilFam DJI Phantom 2 Vision with MAC address now written on the bottom to make life better future users.

Leave a Reply