0

I'm trying to obtain remote signal strength indication (RSSI) from received packets by sniffing the ones having Dot11 headers. But I've heard somewhere that WLAN interface of Mac OSX (en1 interface as default) can't access them, is this true?

In that case, do packets contain anything relevant to RSSI that en1 interface can access?

I've never seen my en1capture packets with 802.11 protocol at all in Wireshark.

  • 1
    802.11 headers don't contain RSSI information. Think of it this way, the station sending the 802.11 frame (and providing the headers) has no way to determine in advance what the RSSI would be at the receiving station. This information is generally radio tap information provided by the drivers of certain wireless devices. Whether the devices on OSX can provide this information to the drivers or whether the OSX drivers recognize or do anything with the information provided, I can't personally say. – YLearn Jul 31 '18 at 22:08
  • @YLearn Thank you for the information. I thought all 802.11 frames contained radiotap headers as default. I know that WLAN interface of Mac OSX can't access MAC headers of 802.11 packets, but I have never seen Wireshark capture them at all. Do all 802.11 frame releasing routers contain Radiotap headers or can they be a source of the problem too? – ShellRox Aug 1 '18 at 6:10
  • 1
    Radio tap information would be inserted by the receiving device. It isn't added in the actual 802.11 frame or transmitted in any way over the air. Wireshark just interprets it as part of the frameas it makes the most sense from a user perspective. 802.11 frames have 802.11 headers, which contains information about source/destination, etc. – YLearn Aug 1 '18 at 17:37
  • @YLearn Thank you! Updating scapy and properly enabling monitor mode displayed Radiotap information without any concern. Perhaps your last comment can be considered as reason of this, I guess there was some complexity between old scapy version and en1 interface or packets that could be inserted with Radiotap headers were simply filtered out due to absence of monitor mode. – ShellRox Aug 1 '18 at 19:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.