I am using scapy to gather stats about wifi traffic for a given MAC. I log the date, type, subtype, and rssi of packets I capture in monitor mode with scapy.

And I see a very low count of data frames (type 2, subtype 0). Why ?

For example, I initiated the download of a 8MB file and the count increased by one or two.

As data frames are approx. 2k in size, I would except a fair amount of data frames being seen for such a download.

The wifi connexion is on a 802.11n with WPA2 on channel 1 captured with a TP-Link TL-WN722N on a rpi3 running archlinux-arm.

Edit: I tried by setting the channel bandwidth to HT40+ (with iw dev wlan1mon set channel 1 HT40+) but I did not see more Data frames either.

Does it have to do with the number of antennas ? the TL-WN722N has only one antenna while the AP has 2, and I guess the latpop too.

But why would I see the other frames, then ?

Edit2: So using tshark -i wlan1mon -Y 'wlan.fc.type_subtype == 0x20' -n -t a -T tabs, I discovered that I am seeing only packet to broadcast or multicast mac like ff:ff:ff:ff:ff:ff, 33:33:00:00:00:01, 01:00:5e:7f:ff:fa

Even if I set the interface in promiscious mode, it is still the same...


Both 802.11n and 802.11ac require QOS (WMM, 802.11e), so all data is sent as Data/QOS-Data (type 2 subtype 8) frames nowadays.

Data/Data (type 2 subtype 0) is a vanishing relic of the bygone a/b/g era.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.