I am using scapy to gather stats about wifi traffic for a given MAC. I log the date, type, subtype, and rssi of packets I capture in monitor mode with scapy.
And I see a very low count of data frames (type 2, subtype 0). Why ?
For example, I initiated the download of a 8MB file and the count increased by one or two.
As data frames are approx. 2k in size, I would except a fair amount of data frames being seen for such a download.
The wifi connexion is on a 802.11n with WPA2 on channel 1 captured with a TP-Link TL-WN722N on a rpi3 running archlinux-arm.
Edit:
I tried by setting the channel bandwidth to HT40+ (with iw dev wlan1mon set channel 1 HT40+)
but I did not see more Data frames either.
Does it have to do with the number of antennas ? the TL-WN722N has only one antenna while the AP has 2, and I guess the latpop too.
But why would I see the other frames, then ?
Edit2:
So using tshark -i wlan1mon -Y 'wlan.fc.type_subtype == 0x20' -n -t a -T tabs
, I discovered that I am seeing only packet to broadcast or multicast mac like ff:ff:ff:ff:ff:ff
, 33:33:00:00:00:01
, 01:00:5e:7f:ff:fa
Even if I set the interface in promiscious mode, it is still the same...