For those that are interested in how this works: it's basically a feature of the 802.11 MAC. When a station STA1 transmits an RTS packet (request to send) to so

For those that are interested in how this works: it's basically a feature of the 802.11 MAC. When a station STA1 transmits an RTS packet (request to send) to some other STA2, STA2 has to respond with a CTS (clear to send) packet (collision avoidance, hidden terminal problem). So basically if a detector knows that a mobile station exists with some MAC address, it can 'ping' it by sending RTS packets to it. It has to know a) the MAC address, which it can learn by overhearing probe request sent by the mobile station when its scanning for access points, and b) the channel the station is on. Of course, you can ping repeatedly on different channels or use multiple Wi-Fi transceivers. Note that when the mobile station is associated with an access point that uses PSM (power saving mode) this does not work because the mobile station is in sleep mode 99% of the time and only wakes up periodically to catch a beacon packet from the access point. By pinging the mobile station and measuring the received signal strength of the CTS response packet at various locations you can triangulate the location of the mobile station (or better yet, use fingerprinting, MLE).