Sniffing WiFi Beacon’s, Probe Requests, and Probe Responses has been discussed in various previous posts and is possible on the Mikrotik WAP’s.
But /interface wireless sniffer sniff requires exclusive access to the radio e.g. it won’t work when CAP is enabled.
Could RouterOS be enhanced so that you could create a VAP specifically for monitoring and use that to sniff WiFi management frames? In the same way it handles multiple SSID’s.
Or does it require a dedicated radio?
Essentially I want to continuously listen for AP’s and devices in the area, and log when they appear.
My guess is VAP won’t help here - AP radio serving clients works on specific channel, so it definitely can hear management frames but on this specific channel only. If you want to sniff management frames on all the channels you have to change current channel of AP radio so all the associated to this AP clients will be disconnected.
You could be right - but then it must be able to listen to multiple channels to be able to listen for beacons & probes when the radio is in a monitor state.
I don’t know either way - was hoping someone here could give a definitve answer with some detail. The alternative is of course a separate physical radio
You need secondary radio. In ROS it’s not possible to run sniffer and AP at the same time… and then you would still be limited to just single channel.
But if you only need to get nearby APs, you can use wifi scanner with “background scan” option, that works even when AP is running and scans all channels in scanlist… but again you will only get beacons (APs).
Thanks r00t. So if you can run “background scan” while its operating as an AP and it scans all channels and finds beacon frames, that says to me that its a software limitation and not a hardware limitation to “background scan” for both beacon and probe request frames. That promising because if its software and not hardware then its achievable with OTB products + custom software.