This is a static archive of our old Q&A Site. Please post any new questions and answers at

802.11 packet injection - 2 packets caught on sending device


When sending out custom constructed frames by packet injection from monitor mode, I noticed something that was peculiar...

While watching the capture in wireshark of the sending wifi module, it seems as if two frames are being sent, when I try to send one(two identical frames i see in the capture), however, when I sniff from a different wifi module ( now purely the receiving one, also in monitor mode ) I only capture one frame. Does anyone know why this is? In what manner does a monitoring device capture frames that it sends - are they captured before they are sent out, and then the driver filters it out somehow, or??

I'm thinking probably I need to understand how wireshark deals with the outbound 802.11 frames.

asked 18 Apr '14, 13:06

itrustedyou's gravatar image

accept rate: 0%

some questions:

  • How did you inject the frame (OS, OS version, tools, etc.)
  • Can you post a sample capture (on google drive, dropbox, taken on the injecting host and one taken on another host (in parallel)
(19 Apr '14, 16:09) Kurt Knochner ♦

Ok, I use the code from mdk3 to 'open' the sending device, and get the descriptor ( I am not sure what exactly happens there ). And then I use the write() C System Call to send the frame I hard coded (including the radiotap header ) on the opened device. The OS is Linux 3.8.0 (Mint 15).

This is the sample capture ( the frames I'm talking about are the two UDP black ones ) from the injecting host (I didn't know about cloudhshark - how very cool!) and here is the one on another host

(19 Apr '14, 17:03) itrustedyou

Hm.. interesting. No idea, but I will have a look.

(19 Apr '14, 17:06) Kurt Knochner ♦

Yay, thanks!

(19 Apr '14, 17:08) itrustedyou

Also, this might be revealing ( i can only share a screenshot, since I don't have a capture or the equipment with me ) . This is what happens when I inject a packet into an ad-hoc network, the targeted device sends all these frames as a response to the first frame, for some reason ( I wish I could disable it though ) , so I'm guessing that only the first one goes through, and the second one is filtered out by the sending device.

(01 May '14, 12:02) itrustedyou