Scapy: get/set frequency or channel of a packet

Question

I have been trying to capture WIFI packets with Linux and see the frequency/channel at which packet was captured. I tried Wireshark and there was no luck and no help. Though using a sample packets from Wireshark, I can see the frequency/channel.

So now I'm experimenting with Scapy. I wanted to figure out the frequency/channel of a sniffed packet, but still no luck. Is there a way to do this with Scapy.

P.S. If there is a better tool than Scapy, or Python, I appreciate comments

Thekla

A valid answer would be one that gives detailed answer as to how to send a packet at a certain frequency/channel – Thekla

Depending on what you want to do in the end I would recommend bettercap.org – Ubiety

@FabianN., thank you. looking into it right now. – Thekla

Answer 1

I found out that RadioTab headers are not part of any Dot11 protocol but are merely added by the network interface. And the reason I got the RadioTab headers on sample packets from Wireshark.org and not from my live wireshark capture is because some network adapters do not add RadioTap while others do and the network adapter of my laptop does not add RadioTab headers. I checked this with a new external WiFi adapter and it did add the RadioTap headers.

If the adapter does not inject the additional information as it captures frames, then no radiotap headers will be added.

So to my main question, how to get/set frequency of a packet. I expected Scapy to have this option but it doesn't, and it shouldn't. The reason is that the frequency depends on what is set on the network adapter. So what I did was to set the frequency/channel of my WiFi adapter to a different one. My external WiFi adapter can work in various channels so I changed each and confirmed with the RadioTap header. There are a simple linux commands/tools that helped me check the supported channels of my WiFi interface, and switch to a particular channel.

To capture/send packets at a certain frequency or channel, you need to change the working channel of your interface and set the sniffer/sender interface in scapy to that interface.

EDIT - Other problems I faced and solutions:

If you are on linux, and you want to change the working channel of your interface you need to disable network-manager for that interface and to do this First Add the following snippet to /etc/network/interfaces

auto $iface
iface $iface inet dhcp
wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

replace $iface with your interface name. This will let you control the interface by yourself. And then add the following lines to /etc/wpa_supplicant/wpa_supplicant.conf

ctrl_interface=/var/run/wpa_supplicant

network={
    ssid="Your_AP_SSID"
    psk="Your_Passphrase"
    freq_list=2412 2437 2462
}

Note that 2412 2437 2462 are the frequencies (channel 1, 6, 11 in this case) for your interface to choose from. You can edit them to desired frequency. Source. But first you have to check that your interface supports these frequencies. To check that

iwlist channel

Finally after everything is done.

sendp(Ether()/IP(dst="1.2.3.4",ttl=(1,4)), iface="wlp3s0")

This will send you packets at the frequency that wlp3s0 is set.

Thekla

@RossJacobs, You just use the common send method on scapy, nothing new. except you change your interface. An example would be sendp(Ether()/IP(dst="1.2.3.4",ttl=(1,4)), iface="eth1") you can set your interface to a certain frequency you like if it supports it. – Thekla

Answer 2

This answer is scoped to the question's title and content: Providing getters and setters for frequency and channel of a packet.

For this solution, use the wpa-Induction.pcap file in Wireshark's Sample Captures.

Poking around

It's useful to poke around one packet to see what fields Scapy has access to in the Scapy interpreter.

>>> pkts = rdpcap('wpa-Induction.pcap')
>>> pkts[0].summary()
"RadioTap / Dot11FCS / Dot11Beacon / Dot11Elt / Dot11EltRates / Dot11Elt / Dot11Elt / Dot11Elt / Dot11Elt / Dot11EltRSN / Dot11Elt / Dot11EltVendorSpecific / Dot11EltMicrosoftWPA / SSID=''"
>>> pkts[0].show()
###[ RadioTap dummy ]###
  version= 0
  pad= 0
  len= 24
  present= Flags+Rate+Channel+Lock_Quality+Antenna+dB_AntSignal+RXFlags
  Flags= FCS
  Rate= 2
  Channel= 2412
  ChannelFlags= CCK+2GHz
  Antenna= 84
  notdecoded= '\x00\x00+\x00\x00\x9fa\xc9\\'

... <output truncated> ...

While 2412 is a frequency and NOT a channel, this is the data we want. RadioTap is the layer per pkts[0].summary(). Putting it together,

>>> frequency = pkts[0][RadioTap].Channel
>>> print(frequency)
2412

Scapy does not provide access to the channel, but it's trivial to convert frequency to channel.

Putting it Together

Getting the Frequency

Given a file and packet number, we can now get the channel and frequency for a packet.

from scapy.all import RadioTap, rdpcap

def getChannel(frequency):
    base = 2407              # 2.4Ghz
    if frequency//1000 == 5: 
        base = 5000          # 5Ghz
    # 2.4 and 5Ghz channels increment by 5
    return (frequency-base)//5

def getFrequency(file, packet_number):
  pkts = rdpcap(file)
  # Scapy mixes up Channel/Frequency here
  frequency = pkts[packet_number][RadioTap].Channel
  return frequency

freq = getFrequency('wpa-Induction.pcap', 0)
chan = getChannel(freq)
print("Channel: {0} \nFrequency: {1}".format(freq, chan))

Setting the Frequency

Let's say we wanted to change the frequency to 5300 and save it. This would only require iterating over the packet list, change the frequency for every packet, and saving the result. In the scapy interpreter:

>>> for i in range(len(pkts)):
...     pkts[i][RadioTap].Channel = 5300
>>> wrpcap('temp.pcap', pkts)
>>> pkts2 = rdpcap('temp.pcap')
>>> pkts[0].Channel
5300

Nowak

@Babydesta I did read the question and scoped this answer to it. You may want to ask a colleague to get a second opinion on how your question/title reads. You may want to reask the question by following the format in how to ask, with an emphasis on the second heading. If you think that this answers the question you asked, please mark it as such. – Nowak