hcxdumptool - missing frames w/ filtering

[ZerBea]

That highly depend on command line options. Add your target ESSID to beaconlist and activate active beaconing

Code:

$ sudo hcxdumptool -i INTERFACE -o dump.pcapng --enable_status=63 --essidlist=beaconlist --active_beacon

Real time display will now show something like this:

Code:

start capturing (stop with ctrl+c)
NMEA 0183 SENTENCE........: N/A
PHYSICAL INTERFACE........: phy0
INTERFACE NAME............: wlp39s0f3u1u1u2
INTERFACE PROTOCOL........: IEEE 802.11
INTERFACE TX POWER........: 20 dBm (lowest value reported by the device)
INTERFACE HARDWARE MAC....: 00e0614861dd (not used for the attack)
INTERFACE VIRTUAL MAC.....: 00e0614861dd (not used for the attack)
DRIVER....................: mt7601u
DRIVER VERSION............: 5.17.4-arch1-1
DRIVER FIRMWARE VERSION...: N/A
openSSL version...........: 1.1
ERRORMAX..................: 100 errors
BPF code blocks...........: 0
FILTERLIST ACCESS POINT...: 0 entries
FILTERLIST CLIENT.........: 0 entries
FILTERMODE................: unused
WEAK CANDIDATE............: 12345678
ESSID list................: 0 entries
ACCESS POINT (ROGUE)......: 000d58c1ce00 (BROADCAST WILDCARD used for the attack)
ACCESS POINT (ROGUE)......: 000d58c1ce01 (BROADCAST OPEN used for the attack)
ACCESS POINT (ROGUE)......: 000d58c1ce02 (used for the attack and incremented on every new client)
CLIENT (ROGUE)............: c02250adb8f5
EAPOLTIMEOUT..............: 20000 usec
EAPOLEAPTIMEOUT...........: 2500000 usec
REPLAYCOUNT...............: 61716
ANONCE....................: 90fe8fc68c095d20c062252428a1654cef944a1a6de60667fde0cecad0f6fb2c
SNONCE....................: 601f7f1a918f639df71a84274c7f8f75ca00da57a24a8646c92305766c36c26b

TIME     FREQ/CH  MAC_DEST     MAC_SOURCE   ESSID [FRAME TYPE]
11:28:33 2472/13  ffffffffffff 0896d798e19e [WILDCARD BEACON]
11:28:34 2472/13  f6c56a62c874 0896d798e19e TEST-HIDDEN-ESSID [PROBERESPONSE]
11:46:43 2462/11  00e62d021987 0896d798e19e TEST-HIDDEN-ESSID [ROGUE PROBERESPONSE]
11:28:39 2472/13  00e62d021987 0896d798e19e TEST-HIDDEN-ESSID [AUTHENTICATION]
11:28:39 2472/13  00e62d021987 0896d798e19e TEST-HIDDEN-ESSID [ASSOCIATION]
11:28:39 2472/13  00e62d021987 0896d798e19e TEST-HIDDEN-ESSID [EAPOL:M1M2ROGUE EAPOLTIME:2121 RC:61716 KDV:2 PSK:12345678]
11:28:40 2472/13  00e62d021987 0896d798e19e TEST-HIDDEN-ESSID [EAPOL:M2M3 EAPOLTIME:1950 RC:3 KDV:2]
11:28:40 2472/13  00e62d021987 0896d798e19e TEST-HIDDEN-ESSID [EAPOL:M3M4ZEROED EAPOLTIME:3329 RC:3 KDV:2]

Explanation:
A CLIENT will not leave the AP it is connected to, if it doesn't receive a BEACON advertising better conditions.
And as a bonus, it will unhide a hidden ESSID.