2

I've been trying to develop a few scripts that can forge custom 802.11 frames and inject them through a monitor mode interface. I have gone through the development documentation of radiotap headers and the various types of frames supported under 802.11 networks.

I've managed to come up with a python script that does the job and successfully injects packets. My first run was to inject deauth frames. All seems well and working, the stations get deauth-ed.

I fire up wireshark over the station which I use to inject, and listen on my monitor mode interface. My issue is that I can see duplicate packets in wireshark. Using the filter wlan.fc.type_subtype == 0x0c I find two packets for every packet that I inject. If I inject ten packets, I see 20 packets in wireshark.

On observing the packet contents, the original packet has the exact same contents that my script specifies, but the duplicate packets have their radiotap fields entirely different. The size is smaller by a few bytes, and the flags are different. I tried a few variations by turning off the bit that corresponds to the presence of FCS, and adding and removing the FCS. When the flag for FCS is set, the duplicate packet has an FCS at its end. If not, wireshark doesn't show me an FCS for the duplicate packet. I, however, haven't seen such behaviour when using aireplay -ng to send deauth frames. I use an Ubuntu 14.

I seek help in the following:

  1. Why am I seeing these duplicate entries?
  2. Is there something that I need to do, like creating a virtual interface and injecting via it, so that the duplicate packets don't get generated?
  3. Are there any specific radiotap fields that I need to include, so that this behaviour doesn't occur?
  4. In general, is there a way I can specify just the 802.11 Mac payload and ask the card to add the FCS and radiotap data by itself?

Here is my script: Deauth.py

Any leads would be appreciated.

Thanks

  • Does the same thing happen if you sniff from a second interface? – multithr3at3d Apr 23 '18 at 4:45

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.