Scapy send probe request and receive probe response
<p>I am trying to do a job that send <strong>802.11</strong> probe request and receive probe response from. But the result is not good.</p>

<p>Here is my sending frame part, I use <code>Scapy</code> in python:</p>

<pre><code>  class Scapy80211(): 
    def  __init__(self,intf='wlan0',ssid='test',\
          source='00:00:de:ad:be:ef',\
          bssid='00:11:22:33:44:55',srcip='10.10.10.10'):
    self.rates = "\x03\x12\x96\x18\x24\x30\x48\x60"
    self.ssid    = ssid
    self.source  = source
    self.srcip   = srcip
    self.bssid   = bssid
    self.intf    = intf
    self.intfmon = intf + 'mon'

    def ProbeReq(self,count=10,ssid='',dst='ff:ff:ff:ff:ff:ff', fc=0):
      if not ssid: ssid=self.ssid
      param = Dot11ProbeReq()
      essid = Dot11Elt(ID='SSID',info=ssid)
      rates  = Dot11Elt(ID='Rates',info=self.rates)
      dsset = Dot11Elt(ID='DSset',info='\x01')
      pkt = RadioTap()\
        /Dot11(type=0,subtype=4,FCfield=fc,addr1=dst,addr2=self.source,addr3=self.bssid)\
        /param/essid/rates/dsset

      print '[*] 802.11 Probe Request: SSID=[%s], count=%d' % (ssid,count)
      try:
        sendp(pkt,count=count,inter=0.1,verbose=1)
      except:
        raise

ssid = 'aa' #This is the AP I want to interact with
sdot11 = Scapy80211(intf='mon0')
sdot11.ProbeReq(ssid=ssid)
sniff(count=10, timeout=5, prn=PacketHandler, filter="type mgt subtype probe-resp")
</code></pre>

<p>I run the code for 20 times there is one time I can get the result.</p>

<p>Besides, the result is also a little strange, when I could receive the response, I often receive a lot at that time.</p>

<p>So, can anyone help me? How do you usually do the send and receive job?</p>

<hr>

<p>I have changed my code to <code>srp()</code>. I remove the sniff() statement and replace the sendp() with srp(). And here is my result, I am quite confused about it. </p>

<pre><code>[*] 802.11 Probe Request: SSID=[aa], count=10
Begin emission:
Finished to send 1 packets.
Begin emission:
Finished to send 1 packets.
Begin emission:
Finished to send 1 packets.
Begin emission:
Finished to send 1 packets.
Begin emission:
Finished to send 1 packets.
Begin emission:
Finished to send 1 packets.
Begin emission:
Finished to send 1 packets.
Begin emission:
Finished to send 1 packets.
Begin emission:
Finished to send 1 packets.
Begin emission:
Finished to send 1 packets.
Begin emission:
Finished to send 1 packets.

Received 0 packets, got 0 answers, remaining 1 packets
[*] 802.11 Probe Request: SSID=[aa], count=10
Begin emission:
Finished to send 1 packets.
Begin emission:
Finished to send 1 packets.
Begin emission:
Finished to send 1 packets.
Begin emission:
Finished to send 1 packets.
Begin emission:
Finished to send 1 packets.
Begin emission:
Finished to send 1 packets.
Begin emission:
Finished to send 1 packets.
Begin emission:
Finished to send 1 packets.
Begin emission:
Finished to send 1 packets.
Begin emission:
Finished to send 1 packets.
Begin emission:
Finished to send 1 packets.

Received 12 packets, got 0 answers, remaining 1 packets
</code></pre>

<p>I want to receive the probe response frame from the <strong>aa</strong>, the one I send probe request to. </p>

<p>So the result is no answer? And I am not sure is it related to that I did not fill in the right parameters like SSID, source, bssid. And should I change the destination from "ff:ff:ff:ff:ff:ff" to the MAC address of <strong>aa</strong>?</p>

<p>Unless I'm wrong, you are sending your probes, then sniffing the responses. If an answer arrives, it is likely that it arrives meanwhile.</p>

<p>You should probably use <code>srp()</code> function that does the job of sending frames and matching the answers.</p>

python wireless scapy 802.11