ivanlei / airodump-iv Goto Github PK

Hi, I'm trying to use scapy_ex to proccess some packets in 802.11, but I don't know why I can't filter beacon frames (type 0 subtype 8).

When I import scapy_ex:

if pkt.haslayer(Dot11):
if pkt.type == 0 and pkt.subtype == 8:

this filter does not work, but without scape_ex It works xD.

Do you know what's going on? or what it's the problem?

Thank you. Regards.

Hi,

When I try to use wrpcap to write the packets I received, all packets are displayed as malformed in wireshark.

I traced the problem to scapy_layers_dot11_RadioTap_extract_padding, it seems that wireshark and scapy (after importing scapy_ex.py) read the packet differently because of the padding location.

If I change the function to (not moving the padding anymore):
'''
def scapy_layers_dot11_RadioTap_extract_padding(self, s):
"""Ignore any unparsed conditionally present fields
If all fields have been parsed, the payload length should have decreased RadioTap_len bytes
If it has not, there are unparsed fields which should be treated as padding
"""
padding = len(s) - (self.pre_dissect_len - self.RadioTap_len)
if padding:
#return s[padding:], s[:padding]
return s, None
else:
return s, None
'''
wrpcap writes a valid wireshark pcap, but then scapy is not parsing the packet anymore.

Ey there. I'm degeneratedlabs (now dlabs, dlabs.co)'s repository mantainer.
I found your repo by chance looking for some stuff (I'm also airoscript-ng's dev) and I was surprised to see that you use our old (really old) repository. We've let that repository (even the domain) down.

I plan to put it back soon, but if it's only for aircrack-ng, you could use official repos.
It should even be in debian since the GPL fix by moving aircrack-ng to use gnutls instead of openssl.

Thanks