Sending a forged Probe Request frame from one machine and capturing it on a second machine.

I have two codes running:


interface = sys.argv[1]

dot11 = Dot11(addr1='ff:ff:ff:ff:ff:ff', addr2='11:11:11:11:11:11', addr3='ff:ff:ff:ff:ff:ff')
probeReq = Dot11ProbeReq()
dot11elt = Dot11Elt()

frame = RadioTap()/dot11/probeReq/dot11elt
sendp(frame, iface=interface)


interface = sys.argv[1]

def packetHandler(pkt):
    if(pkt.haslayer(RadioTap) and pkt.haslayer(Dot11)):
        dot11 = pkt.getlayer(Dot11)
        if(dot11.addr2 == "11:11:11:11:11:11"):
            rssi = str(radiotap.dBm_AntSignal)
            print("Received Probe Request with rssi = " + rssi)
while True:
    sniff(iface=interface, prn=packetHandler, store=0)


The receiver don't always gets the packets.

When I use the loop=1 parameter on sendp() it usually takes around 5k sent packets until the receiver catches a single one.

I've used wireshark to ensure that all Probe Requests are being sent, however, my receiver program seems to ignore most of them, is this a normal behaviour for scapy? Am I doing something wrong?

  • Are you positive both interfaces are transmitting and receiving on the same channel? This is not controlled from your code. Commented Dec 29, 2019 at 0:26
  • Not really, I completely forgot about that. Setting both interfaces to the same channel solved the problem, thanks a lot!
    – Rafael
    Commented Dec 29, 2019 at 9:24

1 Answer 1


It appears the code you are using doesn't check or set the wireless channel for either transmitter or receiver. If they are not on the same channel, they cannot communicate.

Since you have success some of the time, there could be other daemons that are hopping channels (e.g. scanning for available networks). For your code to work, you will need to kill other daemons that are using your wireless card, and force the channel with:

iw dev <interface_name> set channel <channel>

The airmon-ng utility can print out processes that may be using your wireless card.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .