Inaccuracy of the crystal oscillator in the Wi-Fi transmitter and receiver.This frequency offset, colloquially named the Doppler shift, is caused by several factors, chief among them: When observing Wi-Fi packets in the wild, we can notice that each packet has a slightly different carrier frequency. Test setup for demonstrating GNU Radio Wi-Fi transceiverĭon’t have the required hardware? Try the RFtap RDS tutorial instead, using the low-cost RTL-SDR receiver. Presentation about GNU Radio IEEE 802.11a/g/p OFDM Receiver

You can verify that Wireshark supports RFtap by loading this sample RFtap pcap file. See gr-ieee802-11 README for troubleshooting. Verify that you can receive Wi-Fi packets from nearby 5GHz access points by running: gnuradio-companion gr-ieee-80211/examples/wifi_rx.grc. Install GNU Radio from source (I followed these instructions), install GNU Radio’s Wi-Fi IEEE 802.11 a/g/p transceiver. Plenty! You will need a fast Mac or Linux computer (I use Ubuntu 16.04 on Intel i5), a SDR receiver capable of receiving 20MHz bandwidth at a center frequency of ~5GHz such as Ettus N210 or B200. The RFtap protocol is designed to encapsulate any type of packet: Wi-Fi, Bluetooth, or packets from any proprietary protocol. You can think of RFtap as the “glue” between GNU Radio and Wireshark, allowing access to RF metadata from Wireshark or Scapy.

Accurate Carrier and Doppler frequencies of every packet, and more.RFtap is a simple protocol designed to provide RF (Radio Frequency) metadata about packets, such as:

In this post we’ll use GNU Radio’s Wi-Fi receiver, RFtap and Wireshark to detect Wi-Fi MAC spoofing by using the unique carrier offset frequency of each Wi-Fi packet.

Wireshark filter wifi mac address