OBJECTIVE
Send probe request frame subtype=4
and receive probe response subtype=5
with Scapy
Ultimate goal is to detect access points nearby via Scapy ( not by sniffing beacon frames )
The object of this is to learn how to initiate probe requests and collect the responses.
ATTEMPTS
POSSIBLE METHOD 1
Wirelss card in Monitor mode
Broadcasting a probe request to anyone that can hear and recording response into variable immediately
packet = RadioTap()/Dot11(type=0,subtype=4,addr1="ff:ff:ff:ff:ff:ff", addr2="00:11:22:33:44:55",addr3="ff:ff:ff:ff:ff:ff")
response = sr(packet)
POSSIBLE METHOD 2
Wireless card in Monitor mode
Broadcasting a probe request to anyone that can hear and then sniffing for response afterwards
packet = RadioTap()/Dot11(type=0,subtype=4,addr1="ff:ff:ff:ff:ff:ff", addr2="00:11:22:33:44:55",addr3="ff:ff:ff:ff:ff:ff")
sendp(packet)
packets = sniff(count=50, timeout=30)
ISSUES
Neither METHOD 1, nor METHOD 2 provided a successful result for me. I am quite unsure if I am going about this correctly. I have found so much documentation online for "sniffing out probe requests", but this is not what I want to do.