Generating WiFi communication in Scapy tool

Scapy and WiFi

Scapy is a program used to manipulate packets. In this text I will show you how to use it for network communication in 802.11 standard.


Messages exchanged between the access point and customers are formed into frames. Each standard frame has the following structure:

  • MAC header:
    • Frame control (version, type, subtype)
    • Duration/connection ID
    • Sequence control
    • Address fields
  • Content
  • CRC checksum
Picture nr 1. MAC frame

In the address fields, you can define five MAC addresses: destination, receiver, relay, source and BSSID (unique station identifier, usually corresponding to the MAC address of the wireless interface). Type and subtype define frame functions, while version is always two zero bits.

Table 1. Frames types and subtypes

Representation of the frame in Scapy is very simple, just like sending it. However, before starting communication, we have to configure the network card accordingly. First of all, we set it to monitor mode. Thanks to this, we will receive all the packages, not just those intended for us.

wlp5s0 is the name of our wireless interface.

Then we set the channel (frequency) used by our Access Point, by going to the AP administration panel. Alternatively, we can set the next channels until the right one is found.

We will need MAC address of our interface. It can be checked with the command below:

Now we can send a probe request type frame. The recipient’s address is set to broadcast. Other variables should be set accordingly:

The WiFi frame consists of “layers”. Scapy allows you to fold subsequent layers through the overloaded operator “/”.

RadioTap is an additional (not part of the standard) layer, making it easier to transmit information between OSI layers—we will always include it at the beginning of the frame.

The next layer is the MAC header, represented by the Dot11 class (Dot11 is the abbreviated specification name 802.11). Here we specify the type, subtype and addresses. The numbering of addresses is as follows:

  • addr1 – destination/recipient
  • addr2 – relay/source
  • addr3 – BSSID

Subsequent layers are the correct frame content and depend on the previously specified type. Scapy have several defined layers that define frame functions (Dot11Beacon, Dot11ProbeReq, Dot11Auth, Dot11AssoReq…). We would have to create the rest by hand.

Finally, in the Dot11Elt layers, we put the necessary information: SSID, supported speeds (up to eight), additional supported speeds, channel used.

With srp1() we send the created frame and wait for the answer, which we then print out.

Picture nr 2. The look of frame in Wireshark program

Detection of Access Points

The communication taking place in this layer has four main purposes: scanning, authentication, connecting and encryption.

Network scanning is divided into active and passive scanning. Passive consists of listening to capture beacons. These frames are sent by the AP to the broadcast address (ff:ff:ff:ff:ff:ff) and contain, among other things, the SSID address and the number of the channel used.

If we don’t want to wait for the beacon frame to appear, we can actively scan the network by sending (presented earlier) the probe request frame (as the recipient’s address giving the address of the access point or broadcast point). If the AP is within range, it should respond with the probe response frame.

With this information, we can create a simple network scanner. Since devices can communicate at different frequencies, change the channels used by our network card (channel hopping). Type in the terminal:

The first command will display the list of available channels. Then, at an interval of 0.3 seconds, change the frequency used. Channels 1-13 correspond to frequencies ~2.4GHz, while the next channels correspond to ~5GHz.

Now, in a new console window, we run a script to detect access points:

At the beginning we define a dictionary in which we will place already recognized access points. Then we create a call back function, which will be called when you capture each frame. Its task is to filter frames with a beacon or probe response layer and extract the information we are interested in (SSID, BSSID, channel). In the last line we run sniffer.


In normal communication, when a suitable AP is found, there are two phases of connection, authentication and association:

Picture nr 3. States

In Scapy, the above process can be programmed this way:

Deauth, ARP spoofing…

One of the most famous attacks on the WiFi network is Deauthentication DoS, which allows you to disconnect the selected client from the access point. It is trivial to carry out and does not require authentication. The only thing we need is a BSSID of an access point and, possibly of our target. The whole thing is to constantly send deauth frames, impersonating the AP. If you specify a broadcast as the destination address, the connection to all stations will be interrupted. An attack is possible due to lack of development of the standard: management frames, unlike data and control frames, are not encrypted.

Detecting this attack is also easy, just count the number of deauth frames. A sample script that executes this task:

It is much worse with the location of the attacker. In principle, the only option is to measure the signal strength in several places and to determine the source on the principle of triangulation, which is not a simple matter. Amendment 802. 11w (Management Frame Protection) was introduced to defend against these (and similar) attacks. It allows you to encrypt some management frames. It is supported by Linux (disabled by default), Windows from version 8 and newer network equipment.

In a similar way we can detect other popular attacks, such as ARP poisoning or Evil Twin AP. Such solutions usually consist in comparing the information we receive with the information we previously saved in the database. With Scapy, it is quite easy to create basic tools for such activities. You can also use more advanced programs, such as EvilAP_Defender or ArpON.