Scapy - retrieving RSSI from WiFi packets

wifi scapy rssi
kaczor1984 picture kaczor1984 · May 30, 2012 · Viewed 17.6k times · Source

I'm trying to get RSSI or signal strength from WiFi packets. I want also RSSI from 'WiFi probe requests' (when somebody is searching for a WiFi hotspots).

I managed to see it from kismet logs but that was only to make sure it is possible - I don't want to use kismet all the time.

For 'full time scanning' I'm using scapy. Does anybody know where can I find the RSSI or signal strength (in dBm) from the packets sniffed with scapy? I don't know how is the whole packet built - and there are a lot of 'hex' values which I don't know how to parse/interpret.

I'm sniffing on both interfaces - wlan0 (detecting when somebody connects to my hotspot), and mon.wlan0 (detecting when somebody is searching for hotspots). Hardware (WiFi card) I use is based on Prism chipset (ISL3886). However test with Kismet was ran on Atheros (AR2413) and Intel iwl4965.

Edit1:

Looks like I need to access somehow information stored in PrismHeader: http://trac.secdev.org/scapy/browser/scapy/layers/dot11.py line 92 ?

Anybody knows how to enter this information? packet.show() and packet.show2() don't show anything from this Class/Layer

Edit2:

After more digging it appears that the interface just isn't set correctly and that's why it doesn't collect all necessary headers. If I run kismet and then sniff packets from that interface with scapy there is more info in the packet:

###[ RadioTap dummy ]###
  version= 0
  pad= 0
  len= 26
  present= TSFT+Flags+Rate+Channel+dBm_AntSignal+Antenna+b14
  notdecoded= '8`/\x08\x00\x00\x00\x00\x10\x02\x94\t\xa0\x00\xdb\x01\x00\x00'
  ...

Now I only need to set the interface correctly without using kismet.

Answer

kaczor1984 picture kaczor1984 · May 31, 2012

To summarize:

  • signal strength was not visible because something was wrong in the way that 'monitor mode' was set (not all headers were passed/parsed by sniffers). This monitor interface was created by hostapd.

  • now I'm setting monitor mode on interface with airmon-ng - tcpdump, scapy show theese extra headers.

Edited: use scapy 2.4.1+ (or github dev version). Most recent versions now correctly decode the « notdecoded » part

Related questions

Python scan for WiFi

I was searching for a program that can scan for WiFi networks and print all of the SSIDs. I tried with scapy but I failed. I am using the pyCharm editor. I tried this code: from scapy.all import * from …

Read More
Accessing 802.11 Wireless Management Frames from Python

From Python on Linux I would like to sniff 802.11 management 'probe-request' frames. This is possible from Scapy like so: # -*- coding: utf-8 -*- from scapy.all import * def proc(p): if ( p.haslayer(Dot11ProbeReq) ): mac=re.sub(…

Read More
Run/install/debug Android applications over Wi-Fi?

I thought there was a way to test your applications in development over Wi-Fi. Is this possible? I'd love to be able to untether my phone and develop wirelessly.

Read More