Example method includes: receiving, by a network device, a plurality of signal strength values associated with a particular timestamp corresponding to a particular client device from a plurality of access points in a wireless network at a site; determining a mobility pattern based on the plurality of signal strength values associated with the particular timestamp corresponding to the particular client device; comparing the mobility pattern associated with the particular timestamp corresponding to the particular client device with mobility patterns associated with other timestamps or corresponding to other client devices to identify a set of frequent mobility patterns; determining whether an unassociated client device exhibits a threshold number of frequent mobility patterns for a threshold amount of time; and determining that the unassociated client device presents in the site in response to the unassociated client device exhibiting the threshold number of the frequent mobility patterns for the threshold amount of time.