Community discussions

MikroTik App
 
mike548141
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 51
Joined: Sun Aug 16, 2020 5:14 am

VAP to sniff Beacon's and Probe Requests

Tue Nov 16, 2021 11:12 am

Sniffing WiFi Beacon's, Probe Requests, and Probe Responses has been discussed in various previous posts and is possible on the Mikrotik WAP's.
But /interface wireless sniffer sniff requires exclusive access to the radio e.g. it won't work when CAP is enabled.

Could RouterOS be enhanced so that you could create a VAP specifically for monitoring and use that to sniff WiFi management frames? In the same way it handles multiple SSID's.
Or does it require a dedicated radio?

Essentially I want to continuously listen for AP's and devices in the area, and log when they appear.

Thanks,

MC
 
zarianu
just joined
Posts: 16
Joined: Wed Nov 18, 2020 11:42 am

Re: VAP to sniff Beacon's and Probe Requests

Tue Nov 16, 2021 2:07 pm

My guess is VAP won't help here - AP radio serving clients works on specific channel, so it definitely can hear management frames but on this specific channel only. If you want to sniff management frames on all the channels you have to change current channel of AP radio so all the associated to this AP clients will be disconnected.

Regards,
Konstantin
 
mike548141
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 51
Joined: Sun Aug 16, 2020 5:14 am

Re: VAP to sniff Beacon's and Probe Requests

Tue Dec 07, 2021 1:10 pm

You could be right - but then it must be able to listen to multiple channels to be able to listen for beacons & probes when the radio is in a monitor state.
I don't know either way - was hoping someone here could give a definitve answer with some detail. The alternative is of course a separate physical radio

Ta,

MC
 
r00t
Long time Member
Long time Member
Posts: 672
Joined: Tue Nov 28, 2017 2:14 am

Re: VAP to sniff Beacon's and Probe Requests

Tue Dec 07, 2021 5:48 pm

You need secondary radio. In ROS it's not possible to run sniffer and AP at the same time... and then you would still be limited to just single channel.
But if you only need to get nearby APs, you can use wifi scanner with "background scan" option, that works even when AP is running and scans all channels in scanlist... but again you will only get beacons (APs).
 
mike548141
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 51
Joined: Sun Aug 16, 2020 5:14 am

Re: VAP to sniff Beacon's and Probe Requests

Thu Jan 06, 2022 2:18 am

You need secondary radio. In ROS it's not possible to run sniffer and AP at the same time... and then you would still be limited to just single channel.
But if you only need to get nearby APs, you can use wifi scanner with "background scan" option, that works even when AP is running and scans all channels in scanlist... but again you will only get beacons (APs).
Thanks r00t. So if you can run "background scan" while its operating as an AP and it scans all channels and finds beacon frames, that says to me that its a software limitation and not a hardware limitation to "background scan" for both beacon and probe request frames. That promising because if its software and not hardware then its achievable with OTB products + custom software.

MC

Who is online

Users browsing this forum: araqiel, CGGXANNX, Seko777, TheCat12 and 88 guests