Can I find out the WAN IP of Wi-Fi networks nearby?

Question

WiFi

There was a need to find out the WAN IP addresses of access points that are near me. Is it possible to do this without hacking each point separately?

Answer 1

You can only find out the MAC address. The IP address is transmitted in the encrypted part of the frame.
The MAC address is transmitted only on the local network, WAN IP cannot be determined from it.
Even if the network is not encrypted, or the frames were somehow decrypted, IP packets on the local network will have internal client IP addresses as source or destination addresses. WAN IP will be affixed there after NAT, and will go through the interface by which the point is connected to the provider.
Although I found a way with which you can still try to determine the WAN IP. Although this will only be the IPv6 address of the router itself, and not the clients behind it (especially since the subnet for clients may differ from that found).
On many routers (in particular Sercomm from MGTS), IPv6 addresses are assigned by EUI-64, by MAC address. Let's say we managed to find out the MAC address on Wi-Fi, for example, 94:4a:8c:00:11:22. The WAN will have an address of 94:4a:8c:00:11:23 - they are often assigned in a row, and the subnet for IPv6 addresses from a given provider in a given area is known, for example, 2a00:1370:8030::/48.
Then you can ping addresses using the mask 2a00:1370:8030:xxxx:964a:8cff:fe00:1123 (16 bits in total, i.e. 65536 addresses). If one of them answers, this is the desired WAN IP. If the router is leaky, it can hold some kind of management interface at this address.

Answer 2

No. Or connect or "hack".

Answer 3

No, it's also illegal.