From what I have read, hostapd (its used for creating a wifi access-point) creates a mon0.wlan0 interface to send and receive wifi management frames (http://lists.shmoo.com/pipermail/hostap/2012-May/025973.html)

How does a normal wlan interface receive/send 802.11 management frames(for instance probes, beacons). I do not see them when I do a tcpdump on my wlan0 interface. How do applications give us the list of available networks if the management frames do not come on the wlan0 interface at all?

Management frames are sent in-channel just like all other frames passing over the 802.11 media. Not sure why you are not seeing them with your protocol analyser, but its probably listening on the wrong interface (or sub-interface), or is misconfigured.

Differant subtypes of management frames use different destination addressing as needed. for instance Beacons are broadcast frames sent from the WAP at regular intervals. Probe-Request frames are also addressed as Layer 2 Broadcasts, this time sent by the client. The response to the probe however is unicast.

see more info here: http://dot11.info/index.php?title=Chapter_4_-_802.11_Management_frames

  • There are no management frames on the interface(checking via tcpdump), they are only visible when I start the interface in monitor mode. – user3465593 May 14 '14 at 14:35

Here's a partial answer to my question. It seems that the if the interface is not on monitor mode, the adapter supplies packets with fake ethernet headers instead of 802.11 header. Hence I could not view them on tcpdump. Quoting from Wireshark's WLAN Capture guide

When not in monitor mode, the adapter might only capture data packets; you may have to put the adapter into monitor mode to capture management and control packets. In addition, when not in monitor mode, the adapter might supply packets with fake Ethernet headers, rather than 802.11 headers, and might not supply additional radio-layer information such as data rates and signal strength.

Although how the system shows the Available Networks and their signal strengths is still a mystery to me.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.