search

pulkin / esp8266-injection-example

Example project to demonstrate packet injection / sniffer capabilities of ESP8266 IC.
352 stars 92 forks source link

Packet type for deauth #2

Closed jmacwhyte closed 8 years ago

jmacwhyte commented 8 years ago

Hi there,

I've been doing a bunch of testing with my ESP8266 to try and get a better grasp of how everything is working. In your code you set the first two bytes for your deauth packet to 0xC000, but according to this page, I would expect the first two bytes to be 0x0C00 (the first two bits being used for the protocol version). Is this a typo in your code, or am I missing something?

Thanks!

pulkin commented 8 years ago

Hi, I was using wireshark to verify if the packet being sent makes sense. This does not mean that my code is correct, though. Did you try the other way? Here is an example of a deauth packet: click. Probably the answer to your question is that octets are reversed. I kindly ask you to check and report. I will do the same with my ESP.

jmacwhyte commented 8 years ago

Thanks. I was trying to do the same with Wireshark, but unfortunately I haven't been able to get my interface to show the raw 802.11 headers (I'm stuck in "fake ethernet" mode). I was thinking there might be an issue of endianness, which very well may be the case: Stack overflow. I'll play with it some more and let you know if I find anything interesting!

stickytruth commented 8 years ago

The first two bytes of the packet make up the Frame Control Field.

The first byte contains the Subtype (4 bits), Type (2 bits), and Version (2 bits) information.

C0 would be 1100 0000, subtype=12, type=0, version=0.

48 would be 0100 1000, subtype=4, type=2, version=0.

jmacwhyte commented 8 years ago

Interesting... According to all the charts I've seen (like this one), the order of the first FC byte is version, type, and then subtype. But here is an image from Wireshark showing them in the same order as you mentioned.

I don't really understand why that is. Is it just a matter of endianness? Either way, I guess this is off-topic for this Github issue now that the answer has been found :)