I've been trying to develop a few scripts that can forge custom 802.11 frames and inject them through a monitor mode interface. I have gone through the development documentation of radiotap headers and the various types of frames supported under 802.11 networks.
I've managed to come up with a python script that does the job and successfully injects packets. My first run was to inject deauth frames. All seems well and working, the stations get deauth-ed.
I fire up wireshark over the station which I use to inject, and listen on my monitor mode interface. My issue is that I can see duplicate packets in wireshark. Using the filter
wlan.fc.type_subtype == 0x0c I find two packets for every packet that I inject. If I inject ten packets, I see 20 packets in wireshark.
On observing the packet contents, the original packet has the exact same contents that my script specifies, but the duplicate packets have their radiotap fields entirely different. The size is smaller by a few bytes, and the flags are different. I tried a few variations by turning off the bit that corresponds to the presence of FCS, and adding and removing the FCS. When the flag for FCS is set, the duplicate packet has an FCS at its end. If not, wireshark doesn't show me an FCS for the duplicate packet. I, however, haven't seen such behaviour when using aireplay -ng to send deauth frames. I use an Ubuntu 14.
I seek help in the following:
- Why am I seeing these duplicate entries?
- Is there something that I need to do, like creating a virtual interface and injecting via it, so that the duplicate packets don't get generated?
- Are there any specific radiotap fields that I need to include, so that this behaviour doesn't occur?
- In general, is there a way I can specify just the 802.11 Mac payload and ask the card to add the FCS and radiotap data by itself?
Here is my script: Deauth.py
Any leads would be appreciated.