Read 802.11 packets from pcap file using python

Question

I found similar questions but they do not solve my problem

I have a pcap file (screenshot of it opened in Wireshark below) which contains some 802.11 frame data

I tried to read it using the following code I found from this question. But all it printed was the following:

Code:

from scapy.all import Dot11
from scapy.all import sniff

def parse(frame):
    if frame.haslayer(Dot11):
        print("ToDS:", frame.FCfield & 0b1 != 0)
        print("MF:", frame.FCfield & 0b10 != 0)
        print("WEP:", frame.FCfield & 0b01000000 != 0)
        print("src MAC:", frame.addr2)
        print("dest MAC:", frame.addr1)
        print("BSSID:", frame.addr3)
        print("Duration ID:", frame.ID)
        print("Sequence Control:", frame.SC)
        print(feature(frame))
        print("\n")

    else:
        print("Not dot11")


sniff(offline="./testData/test.pcap", prn=parse)

Result:

D:\Apps\Python3\python.exe F:/tes/pcapReader/main.py
Not dot11
Not dot11
Not dot11
Not dot11
...

From this, what I understand is that there are no dot11 packets in my trace, which is confusing because the protocol for most packets is 802.11 according to the Wireshark output.

I also tried to use the dpkt 802.11 package, but didn't get any result

What am I missing here?

(I'm using Python3, if that's any help)

Nht_e0 Nht_e0 · Accepted Answer · 2019-07-16T01:29:01

I found this library called pyshark. It converts the pcap file to xml to make it easily readable regardless of the type of the packet

My code:

import pyshark

cap = pyshark.FileCapture('./test.pcap')
try:
    print(cap[0]['WLAN'])
except:
    pass

Result:

Layer WLAN:
Frame check sequence: 0x4761f1b6 [correct]
0... .... = Order flag: Not strictly ordered
Receiver address: 01:0b:85:00:00:00
.... ..11 = DS status: WDS (AP to AP) or Mesh (MP to MP) Frame (To DS: 1 From DS: 1) (0x3)
Frame Control Field: 0x0803
Type/Subtype: Data (0x0020)
Transmitter address: f0:25:72:70:a3:a0
0000 .... = Subtype: 0
.... .0.. = More Fragments: This is the last fragment
1000 0111 1111 .... = Sequence number: 2175
.... 10.. = Type: Data frame (2)
FCS Status: Good
...0 .... = PWR MGT: STA will stay up
.... ..00 = Version: 0
.... .... .... 0000 = Fragment number: 0
Destination address: 01:0b:85:00:00:00
Source address: f0:25:72:70:a3:a0
.000 0000 0000 0000 = Duration: 0 microseconds
Flags: 0x03
.... 0... = Retry: Frame is not being retransmitted
..0. .... = More Data: No data buffered
.0.. .... = Protected flag: Data is not protected

Read 802.11 packets from pcap file using python

1 Answers