4

OBJECTIVE

Send probe request frame subtype=4 and receive probe response subtype=5 with Scapy

Ultimate goal is to detect access points nearby via Scapy ( not by sniffing beacon frames )

The object of this is to learn how to initiate probe requests and collect the responses.

ATTEMPTS

POSSIBLE METHOD 1

Wirelss card in Monitor mode

Broadcasting a probe request to anyone that can hear and recording response into variable immediately

packet = RadioTap()/Dot11(type=0,subtype=4,addr1="ff:ff:ff:ff:ff:ff", addr2="00:11:22:33:44:55",addr3="ff:ff:ff:ff:ff:ff")
response = sr(packet)

POSSIBLE METHOD 2

Wireless card in Monitor mode

Broadcasting a probe request to anyone that can hear and then sniffing for response afterwards

packet = RadioTap()/Dot11(type=0,subtype=4,addr1="ff:ff:ff:ff:ff:ff", addr2="00:11:22:33:44:55",addr3="ff:ff:ff:ff:ff:ff")
sendp(packet)
packets = sniff(count=50, timeout=30)

ISSUES

Neither METHOD 1, nor METHOD 2 provided a successful result for me. I am quite unsure if I am going about this correctly. I have found so much documentation online for "sniffing out probe requests", but this is not what I want to do.

  • Did you put the correct interface for example sendp(packet,iface=card) where card is your interface name in monitor mode(Double quotes) – sachin Nov 3 '17 at 16:33
1

That's because you didn't include the "Dot11Elt" layer, try this:

RadioTap()/Dot11(type=0,subtype=4,addr1="ff:ff:ff:ff:ff:ff", addr2="00:11:22:33:44:55",addr3="ff:ff:ff:ff:ff:ff")/Dot11Elt(ID="SSID", info="")

or:

RadioTap()/Dot11(addr1="ff:ff:ff:ff:ff:ff",addr2="00:11:22:33:44:55",addr3="ff:ff:ff:ff:ff:ff")/Dot11ProbeReq()/Dot11Elt(ID="SSID", info="")

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.