Linux for Network Engineers: How to do channel hopping during WiFi packet capturing

By May 19, 2021Linux

In a previous post we talked about how to set a WiFi interface to monitor mode manually, but also through a script. In this post, we’ll talk about how to set the channel and the channel width on a monitor interface but also now to do channel hopping while running a packet capture.

For the purposes of this post I use the same setup with the previous post in terms of hardware, WiFi dongle, driver and iw version.

Supported Channels and Widths

In order to be able to set 80 MHz channels with iw, you need version  4.14 or greater. In my case, I have installed version 5.9:

The syntax of settings channels has changed after version 4.14, and in order to get the correct syntax you can enter an incomplete command to get the help output as follows:

Once you set the interface to monitor mode the channel and channel width are left at the same configuration they were while the interface was connected to your WiFi network (if it was ever). In my case, it was on channel 149 at 80MHz:

As always, when setting a channel and channel width we have to make sure that 

  1. They have acceptable values (e.g. we can’t set channel 1 at 40- MHz)
  2. The driver and hardware support the requested channel and width values

The first step it to determine what channels your setup supports with the following:

This output is very useful, but it doesn’t specify explicitly what widths are allowed and supported on each channel. It can be determined by trying to set each width for each channel to see if the driver allows you to avoid throwing any errors or warning messages.  The following two commands will set the channel and also confirm that the channel has been set properly:

If you choose a channel and width combination that is not acceptable you will get an error as follows:

Given that there are 14 channels in 2.4 GHz, 25 in 5GHz, and that you have four channel options (HT20, HT40+, HT40-, 80MHz) you would need to run 156 commands to get that information. Of course, that’s not practical and here is a rudimentary script that takes the channel option as input and prints in the output if the specific channel and width combination are acceptable:

And you get an output as follows:

As you can see, in 2.4 GHz you can set a 40- width in channels 5 to 13.

To get a complete list run the script with the following inputs:

Configure Channel and Width

Now that you know what channels and widths are supported by your hardware, you can simply set the capture channel and width with the following:

And start a basic capture without filters on interface “wlan0” as follows:

I let this run for a few seconds and I stopped it by hitting Ctrl+C. Now you can open this file with a tool like wireshark for further analysis.

Channel Hopping

To do channel hopping, you’d have to change the channel while the capture is running. Practically, that’s not feasible to do manually especially if you need a dwell time in the order of milliseconds. 

Here is a rudimentary script that does the channel hopping across all allowable channels based on the channel width and dwell time of 100 ms

To run this script in parallel with the tcpdump capture you have either to use two different terminals (one for the channel hopping script and one for the tcpdump capture) or to run the channel hopping script as a background process and then launch the tcpdump capturing command as follows:
Once you stop tcpdump with “Ctrl+C” you can stop the channel hopping script with