This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

When sending out custom constructed frames by packet injection from monitor mode, I noticed something that was peculiar...

While watching the capture in wireshark of the sending wifi module, it seems as if two frames are being sent, when I try to send one(two identical frames i see in the capture), however, when I sniff from a different wifi module ( now purely the receiving one, also in monitor mode ) I only capture one frame. Does anyone know why this is? In what manner does a monitoring device capture frames that it sends - are they captured before they are sent out, and then the driver filters it out somehow, or??

I'm thinking probably I need to understand how wireshark deals with the outbound 802.11 frames.

asked 18 Apr '14, 13:06

itrustedyou's gravatar image

itrustedyou
1334
accept rate: 0%

some questions:

  • How did you inject the frame (OS, OS version, tools, etc.)
  • Can you post a sample capture (on google drive, dropbox, cloudshark.org) taken on the injecting host and one taken on another host (in parallel)
(19 Apr '14, 16:09) Kurt Knochner ♦

Ok, I use the code from mdk3 to 'open' the sending device, and get the descriptor ( I am not sure what exactly happens there ). And then I use the write() C System Call to send the frame I hard coded (including the radiotap header ) on the opened device. The OS is Linux 3.8.0 (Mint 15).

This is the sample capture ( the frames I'm talking about are the two UDP black ones ) from the injecting host https://www.cloudshark.org/captures/d9740483f811 (I didn't know about cloudhshark - how very cool!) and here is the one on another host https://www.cloudshark.org/captures/c6480b9d6140

(19 Apr '14, 17:03) itrustedyou

Hm.. interesting. No idea, but I will have a look.

(19 Apr '14, 17:06) Kurt Knochner ♦

Yay, thanks!

(19 Apr '14, 17:08) itrustedyou

Also, this might be revealing http://i.imgur.com/22gMOU4.png ( i can only share a screenshot, since I don't have a capture or the equipment with me ) . This is what happens when I inject a packet into an ad-hoc network, the targeted device sends all these frames as a response to the first frame, for some reason ( I wish I could disable it though ) , so I'm guessing that only the first one goes through, and the second one is filtered out by the sending device.

(01 May '14, 12:02) itrustedyou
Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×114
×36
×1

question asked: 18 Apr '14, 13:06

question was seen: 4,051 times

last updated: 01 May '14, 12:02

p​o​w​e​r​e​d by O​S​Q​A