I am using scapy to gather stats about wifi traffic for a given MAC. I log the date, type, subtype, and rssi of packets I capture in monitor mode with scapy.

And I see a very low count of data frames (type 2, subtype 0). Why ?

For example, I initiated the download of a 8MB file and the count increased by one or two.

As data frames are approx. 2k in size, I would except a fair amount of data frames being seen for such a download.

The wifi connexion is on a 802.11n with WPA2 on channel 1 captured with a TP-Link TL-WN722N on a rpi3 running archlinux-arm.

Edit: I tried by setting the channel bandwidth to HT40+ (with iw dev wlan1mon set channel 1 HT40+) but I did not see more Data frames either.

Does it have to do with the number of antennas ? the TL-WN722N has only one antenna while the AP has 2, and I guess the latpop too.

But why would I see the other frames, then ?

Edit2: So using tshark -i wlan1mon -Y 'wlan.fc.type_subtype == 0x20' -n -t a -T tabs, I discovered that I am seeing only packet to broadcast or multicast mac like ff:ff:ff:ff:ff:ff, 33:33:00:00:00:01, 01:00:5e:7f:ff:fa

Even if I set the interface in promiscious mode, it is still the same...


1 Answer 1


Both 802.11n and 802.11ac require QOS (WMM, 802.11e), so all data is sent as Data/QOS-Data (type 2 subtype 8) frames nowadays.

Data/Data (type 2 subtype 0) is a vanishing relic of the bygone a/b/g era.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .