Wireless Data Packet Capturing with help of scapy

Question

My code That I have tried is as follows:

from scapy.all import *

def PacketHandler(pkt) :

       if pkt.haslayer == 2 and pkt.subtype==0:

          if pkt.haslayer(IP) :

             ip=pkt.getlayer(IP)
             print ip.dst

          if pkt.haslayer(UDP):
               udp=pkt.getlayer(UDP)
               print udp.dport
          if pkt.haslayer(TCP) :
               tcp=pkt.getlayer(TCP)
               print tcp.port

sniff(iface="mon0", prn=PacketHandler)

Using this, I want to capture all wireless DATA packets but I am getting only multicast ( IP/UDP) packets. So how can I get all DATA packet in my wireless network? I have disabled encryption on my access point for this (temporarily) so I can get access to the data in packets.

I think you have to sniff with promiscuous mode https://en.wikipedia.org/wiki/Promiscuous_mode Also, please note that NOT all the network adapters support promiscuous mode. — ρss, Mar 26 '14 at 19:23
@OmidRaha: yes I can see them on wireshark on mon0 interface..... — user3292475, Mar 27 '14 at 02:40
@pss: Yes I have enabled promiscuous/ monitor mode using "airmon-ng start wlan0" command — user3292475, Mar 27 '14 at 02:42
Maybe you can use a better wireless network card. I can't capture the data packets just because mine is terrible — add, Aug 09 '16 at 09:07

score 6 · Accepted Answer · answered Mar 27 '14 at 14:17

If you want to handle only Data frames, and not Management and Control frames, then you can do this:

from scapy.all import *

def packet_handler(pkt) :
    # if packet has 802.11 layer, and type of packet is Data frame
    if pkt.haslayer(Dot11) and pkt.type == 2:
            # do your stuff here
            print(pkt.show())


sniff(iface="mon0", prn=packet_handler)

Also you can use filter option of sniff function to filter only Data frames to go to your packet_handler function:

from scapy.all import *

def packet_handler(pkt) :
    # if packet has 802.11 layer
    if pkt.haslayer(Dot11):
        # do your stuff here
        print(pkt.show())

sniff(iface="mon0", prn=packet_handler, filter="type Data")

Here, is a good list of type and subtype values for frames.

Wireless Data Packet Capturing with help of scapy

1 Answers1