I would like to see precisely at which time my Wifi module is sending/receiving on which Wifi channel, when in infrastructure mode as station.
To be specific my main interest is what happens during the scanning (passive/active) for available access points. Here I want to know, how long it stays in which channel, when it receives beacon frames or probe response frames, or sends out probe request frames.
I would like to investigate this, independent of whether I am associated to an access point or not as in both cases my WiFi will regularly scan for available access points.

Question: Is it possible in any way or form to achieve what I am interested in doing?

Here is what I tried so far:

I thought about using Wireshark to get some better insight, but neiter in promiscuous mode nor in monitor mode I can achieve what I want.

Promiscuous mode: I am able to initiate scans for Access Points, e.g. via wpa_cli on the command line. Futhermore I can connect to an Access Point, where regular scans for other access points happen in the background.
However, I am not able to see any IEEE802.11 management frames on Wireshark in this mode. I assume that my Wifi chipset + drivers only supports "fake" ethernet frames. https://wiki.wireshark.org/CaptureSetup/WLAN

Monitor mode: When the interface is in monitor mode, on the plus side I can see IEEE802.11 management frames on Wireshark.
On the down-side I am obviously not able to connect to an Access Point and monitor how the scanning is done when connected to an Access Point.
Furthermore I cannot initiate any scans for Access Points, but have to set the WiFi channel to monitor manually and therefore I only see management frames on the channel I have set + neighbouring channels (for channel 11 of the 2.4GHz band, I can see frames from channels 9-13).

Is there WiFi hardware that would allow me to see IEEE802.11 management frames also in promiscuous mode?

I tried this on a machine running Ubuntu 16.04.3 LTS with a RTL8723BE WiFi card from Realtek.

  • Any of the Kali Linux tools can also be installed in Ubuntu. Add the Kali repositories to Ubuntu and then apt-get the tools you want. It sounds like you want to be connected to your access point while also scanning neighboring channels. You will need an additional wireless adapter for that. One connected and one wiresharking, airodumping ect. Feb 11 '18 at 18:58
  • Thanks for your suggestion. I also initially thought about using a second wireless adapter. However, take for example the case, when my device does passive scanning. It only listens to beacon frames, while changing the channels to cover all available channels. I would never be able to know at what time it was listening to which channel. On the other hand, if I were able to see the beacon frames on wireshark, I could tell by the channel of the beacon frames, in which channel my WiFi radio was listening at the time.
    – oh.dae.su
    Feb 11 '18 at 19:24
  • Say your connected to WiFi on channel 11 with adapter 1, you would statically set adapter two to listen in-between 1 & 6 i.e on channel 3. You should pick up beacon frames from both 1 & 6, you can also change the hop time on each channel you are scanning. But you are correct, channel hopping would miss most of the info you are trying to capture. The only other way I know of is to put an adapter statically on each channel. Feb 11 '18 at 19:28
  • 99.9% of routers send the beacon intervals x10 times a second (100ms). If you set the hop dwell of your scans to 25-50ms in each channel you should capture alot more of the info your after. Most scanner apps stay on a channel for roughly 250ms. Feb 11 '18 at 19:35
  • Highly appreciate your suggestions. Actually, I am not after the information contained in any of those management frames, but I am more interested in the behaviour of my WiFi, when connected to an access point. When it performs the scanning for other access points (e.g. for roaming, where it looks for SSIDs with the same name), it will for a short period of time move away from the channel of the access point it is connected with. And I am interested to investigate, how long those times are, etc.in order to evaluate the time I am not able to data frames from the connected access point.
    – oh.dae.su
    Feb 11 '18 at 19:44

Use airodump -i network interface

airodump presents channels number of interested Access point

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.