When sending out custom constructed frames by packet injection from monitor mode, I noticed something that was peculiar...
While watching the capture in wireshark of the sending wifi module, it seems as if two frames are being sent, when I try to send one(two identical frames i see in the capture), however, when I sniff from a different wifi module ( now purely the receiving one, also in monitor mode ) I only capture one frame. Does anyone know why this is? In what manner does a monitoring device capture frames that it sends - are they captured before they are sent out, and then the driver filters it out somehow, or??
I'm thinking probably I need to understand how wireshark deals with the outbound 802.11 frames.
asked 18 Apr '14, 13:06