Sending Probe Request Frames | Receving Probe Response — Scapy

Question

OBJECTIVE

Send probe request frame subtype=4 and receive probe response subtype=5 with Scapy

Ultimate goal is to detect access points nearby via Scapy ( not by sniffing beacon frames )

The object of this is to learn how to initiate probe requests and collect the responses.

ATTEMPTS

POSSIBLE METHOD 1

Wirelss card in Monitor mode

Broadcasting a probe request to anyone that can hear and recording response into variable immediately

packet = RadioTap()/Dot11(type=0,subtype=4,addr1="ff:ff:ff:ff:ff:ff", addr2="00:11:22:33:44:55",addr3="ff:ff:ff:ff:ff:ff")
response = sr(packet)

POSSIBLE METHOD 2

Wireless card in Monitor mode

Broadcasting a probe request to anyone that can hear and then sniffing for response afterwards

packet = RadioTap()/Dot11(type=0,subtype=4,addr1="ff:ff:ff:ff:ff:ff", addr2="00:11:22:33:44:55",addr3="ff:ff:ff:ff:ff:ff")
sendp(packet)
packets = sniff(count=50, timeout=30)

ISSUES

Neither METHOD 1, nor METHOD 2 provided a successful result for me. I am quite unsure if I am going about this correctly. I have found so much documentation online for "sniffing out probe requests", but this is not what I want to do.

Answer 1

That's because you didn't include the "Dot11Elt" layer, try this:

RadioTap()/Dot11(type=0,subtype=4,addr1="ff:ff:ff:ff:ff:ff", addr2="00:11:22:33:44:55",addr3="ff:ff:ff:ff:ff:ff")/Dot11Elt(ID="SSID", info="")

or:

RadioTap()/Dot11(addr1="ff:ff:ff:ff:ff:ff",addr2="00:11:22:33:44:55",addr3="ff:ff:ff:ff:ff:ff")/Dot11ProbeReq()/Dot11Elt(ID="SSID", info="")