WO2016178065A1

WO2016178065A1 - Monitoring device, monitoring system and method therefor

Info

Publication number: WO2016178065A1
Application number: PCT/IB2015/054678
Authority: WO
Inventors: Karol Julian KONCZAK; Mikolaj JEDRZEJAK
Original assignee: Signal Group Sp. Z O.O. Sp.K.
Priority date: 2015-05-05
Filing date: 2015-06-23
Publication date: 2016-11-10

Abstract

A monitoring device according to the invention has memory (104), real time module (105), IEEE 802.11 compatible radio module (102) capable of monitoring Wi-Fi devices within a communication range to detect their MAC addresses and communication means (103) for communicating with remote server, all connected to the central unit (101). The monitoring device further has: - means for receiving a list of ignored MAC addresses from a remote server via communication interface, - means for comparing detected MAC address of Wi-Fi device against the list of ignored MAC addresses, - means for storing in the memory (104) the MAC addresses of the Wi-Fi device within the memory (104) together with the time stamp to form the monitoring data, - means for uploading monitoring data stored in the memory (104) to the server in a time interval. A monitoring system according to the invention comprises a server (201) and at least the first monitoring device (100a,100b,100c) as defined in any of the claims 1 to 4, disposed within a facility under monitoring. The server (201) has a means for receiving the monitoring data from at least the first monitoring device (100a,100b,100c) via telecommunication network and has means for identifying in the received monitoring data MAC addresses of devices that meet predetermined criteria, to form a list of ignored MAC addresses, means for sending this list of ignored MAC addresses at least to the first monitoring device, means for receiving a query of the user, means (202) for analysis of monitoring data according to the received query of the user and his privileges, visualization means (204) for presenting the results of the analysis to the user. A method of monitoring according to the invention comprises the first step of storing MAC addresses with time stamps to the memory (104) of monitoring device (100a, 100b, 100c) to form monitoring data, a step of forming the list of background MAC addresses, wherein on the list of background MAC addresses there are entered MAC addresses of devices that meet either first criterion of being in range of monitoring device (100a,100b,100c) for at least predefined percentage of time measured or second criterion of being in range of the monitoring device (100a,100b,100c) in a predefined regular pattern. The method further comprises the second step of storing the MAC addresses with time stamps to the memory (104) to form the second monitoring data being output data, wherein MAC addresses that are on the list are not stored into memory (104).

Description

Monitoring device, monitoring system and method therefor Field of the invention

[ 0001 ] The invention concerns identification and monitoring of the mobile radio equipment provided with radio interface. State of the art

[ 0002 ] In the art there are known devices and systems capable of identification of proximity of other devices and communication therewith in an ad hoc manner. They are usually based on point-to- point radio standards, namely IEEE 802.15, so called Bluetooth, and its variants.

[ 0003 ] For nearly ten years mobile communication devices including telephones, tablets and portable computers have been by default provided with Bluetooth interface. Therefore it is possible to detect their presence next to the Bluetooth terminal device, so called beacon, on condition that Bluetooth module of said devices is active and there is an application running on the devices for the purpose of establishing connection with said beacon. The location information of the mobile device is based on the fact that it is known to be within a Bluetooth range from the known location of the beacon.

[ 0004 ] When such application is running on the mobile communication device, then state of the art systems are not only able to detect the presence of the device in the proximity of terminal, but also to present specific location-based content to the user of said device. An example of such system is given in European Patent EP1358776. Similar systems are used for counting the customers of the malls and providing them with location-based advertisements. However, as it is described below it is not easy to use such systems to monitor the presence of customers in the facilities such as malls and measure the customer flow.

[ 0005 ] There are also Bluetooth-based localization systems such as the system disclosed in European patent EP2347278, in which position of the mobile device is determined on a base of the signal received from a plurality of Bluetooth beacons.

[ 0006 ] The problem is that in the sake of preserving the battery most of the users of mobile communication devices turn the Bluetooth off during their normal use. Hence those users can neither be counted nor provided with advertisement.

[0007] More recently, the IEEE 802.11 radio interface, so called Wi-Fi, started to be included in vast majority of portable devices. Wi-Fi, as opposed to Bluetooth, works in point-multipoint communication configuration. Consequently, Wi-Fi devices tend to broadcast their MAC address. Moreover, Wi-Fi is a medium usually used for Internet connection and hence it is turned off less frequently than.

[0008] Wi-Fi has significantly higher range than Bluetooth. Due to the fact that it is used for Internet distribution, the number of Wi-Fi devices in single building is usually very high. This number includes permanent and temporary Wi-Fi access points as well as devices used by people who are not customers, but are temporarily or permanently employed. That means that counting Wi-Fi modules does not give a reliable measure of customers or visitors and, due to the higher range, it is difficult to determine the location of the mobile device. That is why state of the art Wi-Fi monitoring systems, such as disclosed in US application no US 13/953,564, do not provide information about location of the terminal.

[0009] Known Wi-Fi monitoring devices use the same principle as older and well known Ethernet monitoring devices. They log every device connected or every device that even was within a range. That is why such Wi-Fi monitoring devices cannot be used to monitor the facilities and measure the customer flow, since the monitoring results are affected by the devices carried by facility staff and by local Wi-Fi infrastructure.

[0010] Moreover, there is no state of the art solution for monitoring separately a number of individual facilities and providing the aggregation of data and visualization.

[0011] It is an object of the present invention to solve problems with state of the art monitoring devices and systems listed above.

Summary of the invention

[0012] A monitoring device according to the invention has central unit, memory connected to the central unit, IEEE 802.11 compatible module connected to the central unit, capable of monitoring Wi-Fi devices within a communication range to detect their MAC addresses and communication means connected to the central unit for communicating with remote server. The monitoring device further has :

- means for receiving a list of ignored MAC addresses from a remote server via communication interface,

- means for comparing detected MAC address of Wi-Fi device against the list of ignored MAC addresses,

- means for storing in the memory the MAC addresses of the Wi-Fi device within the memory together with the time stamp to form the monitoring data,

- means for uploading monitoring data stored in the memory to the server in a time interval.

[ 0013 ] Advantageously, the monitoring device further comprises a power limiting means to limit communication range to given area.

[ 0014 ] The monitoring device advantageously has an antenna having radiation pattern substantially corresponding to the shape of the given area. It allows precise coverage of the area that is monitored .

[ 0015 ] The means for uploading advantageously work simultaneously with the means for detecting.

[ 0016 ] Alternatively, IEEE 802.11 compatible module and communication means are the same device and in that means for detecting work in first time intervals and means for uploading work in second time intervals wherein first and second time intervals do not overlap and the second time interval is at least 10 times shorter than the first time interval. The difference between time intervals allows storing larger amount of the data before transmission and more effective usage of the transmission link. It also opens possibility of compressing the data before transmission.

[ 0017 ] A monitoring system according to the invention comprises a server and at least the first monitoring device according to the invention, disposed within an facility, wherein the server has a means for receiving the monitoring data from at least the first monitoring device via telecommunication network. The server further has means for identifying in the received monitoring data MAC addresses of devices that meet predetermined criteria, to form a list of ignored MAC addresses. The server has further means for sending this list of ignored MAC addresses at least to the first monitoring device. That list is applied therein to ignore the background MAC address in monitoring. The server further has means for receiving a query of the user, and means for analysis of monitoring data according to the received query of the user and his privileges. The privileges are used to provide for certain users limited possibility of queries. The results of analysis is presented with visualization means to the user.

[0018] Advantageously the predetermined criteria include condition that MAC address either was within a range of IEEE 802.11 compatible module of at least the first monitoring device ( 100a, 100b, 100c) for predefined percentage of time or appeared in the within a range of IEEE 802.11 compatible module of the first monitoring device in a predefined regular pattern. The predefined percentage of time may be for example 80% and more. Predefined regular pattern may consist in appearing for substantially fixed period of time and in substantially fixed time intervals. Devices being within range for more than 80% time are very likely to be part of the infrastructure of the facility, while devices appearing in regular pattern likely belong to the staff of the facility. Both form the background from the in the monitoring data.

[0019] Advantageously the system according to the invention further has at least the second device according to the invention and it has means to create separate lists of ignored MAC addresses for the first and the second monitoring devices and it has means for merging the monitoring data sent by first and second device to obtain single database containing list of the devices and record of their coming within a communication range and exiting communication range of any of the first and second device. Thanks to that more comprehensive analysis of the data from similar facilities can be obtained.

[0020] The system advantageously further comprises a real time device providing at least accurate time signal at least to the first monitoring device, preferably more. This real time device can be a local machine with real time clock (RTC) or remote server. The time can be also synchronized to the independent time source such as used in radio controlled clocks or to the time distributed in GPS system. It results in enhanced synchronization between particular monitoring devices and better positioning abilities.

[0021] A method according to the invention for filtering background MAC addresses in the monitoring system with monitoring device comprises the first step of storing MAC addresses together with time stamps to the memory of monitoring device to form the monitoring data, the step of forming the list of background MAC addresses, wherein on the list of background MAC addresses there are entered MAC addresses that are stored in memory in regular pattern. In the second step of storing the MAC addresses with time stamps to the memory to form the second monitoring data, MAC addresses that are on the list of ignored MAC addresses are not stored into memory.

[ 0022 ] Advantageously detection of regular pattern involves detection of the devices that meet either the first criterion of being in range of monitoring device for more than 80% of time measured or the second criterion of being in range of the monitoring device regularly for substantially fixed period of time and in substantially fixed time intervals.

[ 0023 ] Also advantageously nearly any adaptive algorithm including neural networks can be involved in the step of forming list of background MAC addresses to detect regular patterns.

[ 0024 ] Advantageously MAC addresses meeting the first criterion and MAC addresses meeting the second criterion are added to the list of ignored MAC addresses in two separate steps.

[ 0025] The method according to the invention advantegeously includes a step of receiving a command upon which list of ignored MAC addresses is deleted and all steps are repeated.

[ 0026 ] In the method according to the invention the list of ignored MAC addresses is deleted and all steps are repeated in that in predetermined time intervals.

[ 0027 ] After the list of ignored MAC addresses is created it is advantageously supplemented continuously with addresses appearing in monitoring data that meet either first or second criterion.

[ 0028 ] Advantageously the monitoring system contains at least three monitoring devices covering at least partly the same area. The method according to the invention executed in that system advantageously comprises step of determining the position of the device corresponding to detected MAC address based on the monitoring data received from all three monitoring devices. Description of figures

[ 0029 ] Embodiments of the present invention are below presented with reference to the following figures: Fig. 1, showing a block diagram of the device according to the invention,

Fig. 2, showing a block diagram of the embodiment of the system according to the invention,

Fig. 3, showing a flow chart of the method according to the invention .

Embodiments of the invention

[0030 ] A block diagram of a simple example of the monitoring device according to the invention is presented in Fig. 1. It comprises a central unit 101, which is a single board computer Raspberry Pi, provided with external IEEE 802.11 compatible radio module 102 implemented as the wireless network card RT5370, that is able to communicate according to the family of standards commonly called Wi-Fi. It is used for monitoring Wi-Fi devices within its range. Typically means used for detection of Wi-Fi devices in the range are a procedure run on Central unit 101. Central unit 101 is adapted to acquire from the radio module 102 MAC addresses of the devices within its range, to form monitoring data that minimally are a set of pairs {time stamp}, {MAC address}. By multiple repetitions of acquisition in consecutive time intervals a sampling effect is obtained. Multiple acquisitions make it possible to observe in monitoring data certain amount of addresses and the time moments in which they were present within the range. To guarantee the exact time measurement, the monitoring device according to the invention has real time clock module 105 connected to the Central Unit 101 or integrated to any of the subsystems of the monitoring device.

[0031 ] It is possible to use external source of accurate time, such as radio time or global positioning system to periodically correct the accuracy of real time clock module 105.

[0032 ] Alternatively or additionally, accurate time can be downloaded from the appropriate device - local machine or server. In such case real time module such as real time clock module 105 is not required in the monitoring device. What is only needed is an interface to the external real time device. Such approach is particularly advantageous when there are multiple monitoring devices distributed to monitor large facility. When they use same time signal source, they are well synchronized. [ 0033 ] Naturally, IEE802.11 compatible radio module 102 can be implemented as integrated circuit placed on the same printed circuit board with the remaining circuits of the device according to the invention. Also, many possible alternative network cards and modules that are available on the market can be used, provided that they support monitoring mode.

[ 0034 ] The monitoring device 100 adapted to work with a server is further provided with communication means 103 which in this example is typical Ethernet interface. It is used to periodically upload the monitoring data to the server and receive configuration data from the server.

[0035 ] Communication means 103 are connected with the central unit 101 and are used to send the monitoring data to the external server via telecommunication network. Communication means 103 may be implemented as any communication interface. Usually, they are Ethernet network card or integrated module. They can be LTE/3G/GPRS modem, telephone modem or even Bluetooth or Wi-Fi module.

[ 0036 ] In an embodiment of the invention communication means 103 and IEEE 802.11 radio module 102 can be the same physical device. In such case the monitoring has to be stopped in repeating, but relatively short time intervals required for transmission of the monitoring data to the server.

[ 0037 ] Optionally, monitoring data contain records that comprise not only time stamp and MAC address, but also monitoring device identifier and facility identifier. Advantageously the identifier manufacturer of the device is stored in the same record in different field.

[ 0038 ] Optionally the range of IEE 802.11 radio module 102 can be limited with additional means. This means can involve antenna with particular radiation pattern or simple attenuation of the signal. Usage of such means is advisable in situations when area of the facility should be precisely covered and accidental detection of the devices outside it is highly undesirable.

[ 0039 ] There are a number of formats for time stamps. Usually format yyyy-mm-dd.HH:MM:SS.UU is used e.g. 2014-12-04.14:34:27.543176, where yyyy stands for four digits representing year, mm stands for two digits representing number of month, dd stands for two digits representing number of day in the month, HH stands for two digits representing hour, MM stands for minutes, SS stands for second and UU stands for microseconds. MAC addresses are usually hexadecimal numbers with digits grouped by two and separated with dots, colons, dashes or without any separator, eg. 51-32-31-2A-7D-C9.

[ 0040 ] If all fields listed above are used the database, records has a format of { timestamp }, {MAC },{ facility ID }, {monitoring device ID, manufacturer ID}. {Timestamp} indicates time of recording. The {MAC} indicates MAC address of the device in range. The {facility ID} identifies the facility in which monitoring device 100 is located - usually it is wireless network ID. The {monitoring device ID} is a unique identifier of the monitoring device. Depending on the configuration it may be or may not be identical to the {facility ID}. {Manufacturer ID} is an identifier of the manufacturer of the user mobile device. Depending on the user mobile device this information may be or may not be broadcasted, hence this identifier may assume value "void".

[ 0041 ] Storing the ID of monitoring device allows easier aggregation of the monitoring data from different facilities.

[ 0042 ] The monitoring device is further provided with memory 104 in a form of SD card for temporary storage of the monitoring data. The monitoring device 100 is further provided with communication interface 103 which in this example is typical Ethernet interface. It is used to periodically upload the monitoring data to the server and receive configuration data from the server.

[ 0043 ] Data uploaded to the server are analyzed to identify MAC address that constitute a background unrelated to the devices actually visiting the area. In the facility such, MAC addresses are related to local Wi-Fi infrastructure including computers and access points, as well as to the devices belonging to the staff of the facility and staff of its associates, such as cleaners or catering staff. Such background should not influence the analysis, and hence should be disregarded. Background identified in uploaded data is used to form a list of MAC addresses that is downloaded by the monitoring device 100. After this moment, the MAC addresses on the downloaded list are not recorded by monitoring device 100 according to the invention. Such approach limits the amount of transmitted data and requires lower capacity of the memory 104 of the monitoring unit .

[ 0044 ] Block diagram of an embodiment of the system according to the invention is presented in fig. 2. This system provides possibility of analyzing a network of facilities by connecting a number of monitoring devices 100a, 100b, 100c to the same server 201, provided with means for data analysis 202 and coupled visualization means 203. Visualization means 203 are adapted to present whole or selected portion of the monitoring data to the user, depending on his credentials and the query he enters.

[ 0045 ] Means for analysis 202 and visualization means 203 can be integrated with the server or located remotely, connecting with the server via communicating network.

[ 0046 ] There are also multiple possible ways of implementing the monitoring device 100, 100a, 100b, 100c. Basically, the central unit 101 can be based on any microcontroller or microcomputer or microprocessor that is fast enough and structurally adapted to cooperate with Wi-Fi modules, such as wireless network cards or dongles. This includes ARM or even ATmega microcontrollers as well as FPGA. It is also possible to integrate central unit 101, radio module 102, communication means 103 and memory 104 on single PCB board in single device.

[ 0047 ] A flow chart of an exemplary method according to the invention is presented in Fig. 3. At first in the step 301 the MAC addresses are acquired by central unit 101 of the monitoring device 100 from the radio module 102 in the first predefined time intervals. They are stored in the memory 104 together with acquisition time, so that in time memory is gradually filed with monitoring data. In second predefined time intervals communication with server 201 is tested in step 302 and in step 303 decision is made and the monitoring data are either send or stored in local memory. If there is communication, the monitoring data from the memory 104 are uploaded by the monitoring device 100, 100a, 100b, 100c to the server 201 in step 304. Otherwise test 302 of communication is repeated after the step 311 of storing the data locally and waiting for the third time interval. The first time interval is usually significantly smaller than the second time interval so that certain amount of data was stored between uploads. Third time interval may be equal to the second or have a value in in-between the value of the first and the second interval.

[ 0048 ] In step 305 the raw monitoring data are stored in the database. The raw monitoring data include records containing identifier of the facility, identifier of the wireless network, pair of time stamp and MAC address. Optionally, in additional of field of the record a manufacturer of the Wi-Fi device that appeared in range is also stored.

[ 0049 ] Subsequently preliminary analysis is executed in step 306 to form ignore list of the MAC addresses that are not to be recorded. It is a multistage analysis. In the first run monitoring data are parsed to identify MAC addresses of the Wi-Fi devices that are present in significant percentage of time e.g. more than 80% of monitoring time moments. They are used as a preliminary ignore list for the configuration data. The configuration data are sent in step 310 to the monitoring device 100. Monitoring device applies preliminary ignore list before sending next monitoring data. Reasonable time of acquisition of the next monitoring data is 3 working days.

[0050 ] In analysis of the next monitoring data they are parsed to identify regular pattern of appearance of the device. Typical set of patterns includes:

• once every hour for less than 5 minutes - security staff)

• three times daily for less than one hour - goods supply; · eight continuous hours - regular employee.

[ 0051 ] Naturally, other patterns can be predefined according to the schedules within the facility or even adaptive pattern detection can be applied.

[0052 ] All MAC addresses that appear according to the predefined pattern are added to the ignore list.

[0053 ] After subsequent 3 working days ignore list is complete and is again sent to the monitoring device 100.

[0054 ] Annually or even more frequently the system should be restarted to detect a background again. Alternatively, the background can be identified adaptively during the normal operation of the entire system.

[ 0055 ] Alternatively, the list of ignored MAC addresses can be gradually supplemented with new MAC addresses as they appear in the data. In such event oldest MAC addresses on the ignore list can be deleted after a period of time to be reentered if they are still in the background or to be permanently deleted when corresponding devices are turned off.

[ 0056 ] In alternative embodiment of the system and method according to the invention in the facility under monitoring three monitoring devices 100a, 100b, 100c are located and information about the signal strength of the IEEE802.il query from the user mobile equipment is included in the data sent to the server from every monitoring device. On server side it is then possible to determine estimation of mobile equipment location using any typical localization technique known in the state of the art. Clocks or real time modules of the three monitoring devices 100a, 100b, 100c should be synchronized when high accuracy is needed.

[ 0057 ] It is obvious for the person skilled in the art after reading this specification that the monitoring device or monitoring devices can be configured to provide monitoring data that contain more information derivable from received Wi-Fi broadcast frame transmitted by user mobile equipment, not only manufacturer identifier, wireless network identifier or signal strength. Such configuration makes analysis and merging of the data from a number of facilities easier. E.g. analysis of manufacturer names enables identification of the correlation between the mobile equipment type with behavioral pattern of its user.

[ 0058 ] Those skilled in the art after reading this specification will easily and routinely recognize that any known adaptive algorithm suitable for detecting regular events, including neural networks can be used to detect particular behavioral patterns in monitoring data.

Claims

1. A monitoring device having a memory (104), an IEEE 802.11 compatible radio module (102) capable of monitoring Wi-Fi devices within a communication range to detect their MAC addresses, and communication means (103) for communicating with a remote server, all connected to the central unit (101), characterized in that it further has:

- means for detecting MAC address of a Wi-Fi device in range of IEEE 802.11 compatible module,

- means for receiving a list of ignored MAC addresses from the remote server via communication means (103),

- means for comparing MAC address of a Wi-Fi device detected by IEEE 802.11 compatible radio module (102) against the list of ignored MAC addresses,

- means for storing in the memory (104) the MAC addresses of the Wi-Fi device within the memory (104) together with the time stamp to form the monitoring data,

- means for uploading monitoring data stored in the memory

(104) to the server using communication means (103) .

2. The monitoring device according to the claim 1, characterized in that it further comprises a power limiting means to limit communication range to given area.

3. The monitoring device according to the claim 1 or 2, characterized in that it further has an antenna having radiation pattern substantially corresponding to the shape of the given area.

4. The monitoring device according to any of the preceding claims characterized in that means for uploading monitoring data work simultaneously with the means for detecting MAC address.

5. The monitoring device according to any of the claim 1 or 2 or 3, characterized in that IEEE 802.11 compatible radio module (102) and communication means (103) are the same device and in that means for detecting MAC address work in first time intervals and means for uploading monitoring data work in second time intervals, wherein first and second time intervals do not overlap and the second time interval is at least 10 times shorter than the first time interval.

6. A monitoring system comprising a server (201) and at least the first monitoring device ( 100a, 100b, 100c) as defined in any of the claims 1 to 5, disposed within a facility under monitoring, wherein the server has means for receiving the monitoring data from at least the first monitoring device ( 100a, 100b, 100c) via telecommunication network and has means for identifying in the received monitoring data MAC addresses of devices that meet predetermined criteria, to form a list of ignored MAC addresses ,

means for sending this list of ignored MAC addresses at least to the first monitoring device,

means for receiving a query from the user,

means (202) for analysis of monitoring data according to the received query of the user and his privileges,

visualization means (203) for presenting the results of the analysis to the user.

7. The monitoring system according to the claim 6, characterized in that predetermined criteria include condition that MAC address

either

was within a detection range of IEEE 802.11 compatible module of at least the first monitoring device ( 100a, 100b, 100c) for more than predefined percentage of monitoring time or

continued to appear within a detection range of IEEE 802.11 compatible module of the first monitoring device in a predefined regular pattern.

8. The system according to the claim 6, characterized in that it further has at least the second monitoring device as defined in any of the claims from 1 to 4, it further has means to create separate lists of ignored MAC addresses for the first (100a) monitoring device and the second (100b) monitoring device, it further has means for merging the monitoring data sent by the first and the second monitoring device to obtain a single database containing list of the devices and store of their entering into a detection range and exiting detection range of any of the first (100a) and the second (100b) monitoring device.

9. The system according to any of the claims from 6 to 8, characterized in that it further comprises a real time device providing at least the first monitoring device ( 100a, 100b, 100c) with an accurate time signal.

10. A method of monitoring with the monitoring system having at least one monitoring device (100a, 100b, 100c), the method comprises the first step of storing MAC addresses with time stamps into the memory (104) of monitoring device (100a, 100b, 100c) to form monitoring data,

a step of adaptive detection of regular patterns of MAC address being stored,

a step of crating the list of background MAC addresses, including entering on the list of background MAC addresses the MAC addresses of devices that are detected in regular pattern,

the second step of storing the MAC addresses with time stamps into the memory (104) to form the second monitoring data being output data, wherein MAC addresses that are on the list of background MAC addresses are not stored into memory (104) .

11. A method according to the claim 10, characterized in that detection of regular patterns involves detection of MAC addresses of devices that meet either

first criterion of being in range of monitoring device ( 100a, 100b, 100c) for more than predetermined percentage of time or

second criterion of being in range of the monitoring device ( 100a, 100b, 100c) according to a regular pattern for substantially fixed period of time and in substantially fixed time intervals.

12. A method according to the claim 10 or 11, characterized in that MAC addresses of devices that meet the first criterion and MAC addresses of devices that meet the second criterion are added to the list of ignored MAC addresses in two separate steps.

13. A method according to any of the claims 10 to 12, characterized in it includes a step of receiving a command upon which the list of ignored MAC addresses is deleted and the method is executed again.

14. A method according to any of the claims 10 to 13, characterized in that in predetermined time intervals the list of ignored MAC addresses is deleted and the method is executed again.

15. A method according to any of the claims 10 to 14, characterized in that after the list of ignored MAC addresses is created, it is supplemented continuously with addresses appearing in monitoring data and meeting either the first or the second criterion.

16. A method according to any of the claims 10 to 15 characterized in that the monitoring data further comprise facility identifier.

17. A method according to any of the claims 10 to 16 characterized in that it is executed by means of the first monitoring device (100a) and at least by means of the second monitoring device (100b, 100c) and includes further step of merging the monitoring data from different monitoring devices.

18. A method according to any of the claims 10 to 17, characterized in that the monitoring system contains at least three monitoring devices (100a, 100b, 100c) covering at least partly the same area and the method comprises further step of positioning the user equipment corresponding to detected MAC address based on the monitoring data received from all three monitoring devices.