Sunday, December 8, 2019

Troubleshooting Wifi device - need low level WiFi Sniffer

I'm troubleshooting an issue where ESP8266 Microcontrollers frequently don't respond to ARP requests when connected to a Mikrotik Access Point if they're configured to use any kind of sleep (which is enabled by default). This appears to be a common issue rather than a code or configuration problem.

Investigations so far suggest that this is related to the way APs buffer broadcast packets and wait for the next time the client wakes up before forwarding the packet.

To troubleshoot, I've setup an unencrypted Wifi network and used Airodump-ng to dump the frames to a pcap, however it seems to "simplify" the traffic. E.G if one host pings another I'd expect to see the frame twice, one from client to AP, and again from AP to the client being pinged. However I only see one frame. Similarly for ARP I only see it once. Assuming it's being buffered correctly, I'd expect to see several times, once from client to the AP, the client broadcasting it to all connected clients, and then again each time a sleeping client wakes up and requests pending frames.

Is there a free / FOSS tool that captures Wifi frames in this detail? Or have I configured Airodump-ng in correctly?

Thanks



No comments:

Post a Comment