Default scanning channels 1,6,11

[vertexgamer]

Is there a reason on why the default scan range is only limited to a few channels (like the adapter is too slow switching channels for successfully capture handshakes etc....... or reasons similar to what's written on "lessons_learned)?

[ZerBea]

It takes too long to scan an entire frequency range.
Let's say your interface support 13 2.GHz channels and the stay time is 5 seconds
To scan the entire range: 5 * 13 = 75 seconds
The typical range of a 2.4 GHz wifi signal is 50 meter (best case without hinds)
Walking speed of a pedestrian is 3.5 km/h = 0,97222 meter/second (let's round it to 1 meter/second)
If all channels have been scanned 75 s) you are 75 m away from the transmitter (and out of range).

[ZerBea]

I forgot to mention that you always can override the default by -F or -f or -c option.

[vertexgamer]

Thanks for the tip. I will try running some tests to see what works better for me. Maybe i could try to decrease the stay time to 3s to compensate for the additional channels

[ZerBea]

3 seconds is far too little. My laboratory test target need much more time to respond.
This is related to the utilization of the radio channel and the performance of the router and the connected CLIENTs.
It takes up to 5 seconds until the target responds.
I suggest to set up an environment and to evaluate the respond times (running tshark in parallel).
It also depend on how fast the attack device changes the channel -> some devices are slow.

[ZerBea]

Please also try hcxlabtool:
https://github.com/ZerBea/wifi_laboratory
Due to too many features, hcxdumptool has become toothless (e.g. the real time display takes too much CPU cycles).

[vertexgamer]

Perfect, i will absolutely try hcxlabtool!
Maybe in the future tho, once i have a controlled lab environment and something more powerful but portable than a rpi3

[vertexgamer]

Hey Zer, do you happen to have or could you extract from your captures a list of essids and channels? Or share what are the most used channels by AP you found. My list only contain a few AP
It's probably pretty obvious to experienced users, but i just noticed how much overlap 2.4ghz channels have to each others, now i get why you particularly choosen 3,6,11

[ZerBea]

It's probably pretty obvious to experienced users,...
That's right, because hcxdumptool/hcxtools are not "easy to use tools".
Experience is helpful to understand why hcxdumptool works the way it does.
If you're familiar with tshark or Wireshark it should not be a problem to use hcxdumptool/hcxtools.

[ZerBea]

A typical stats:
duration of the dump tool (minutes)......: 164

frequency statistics from radiotap header (frequency: received packets)
-----------------------------------------------------------------------
 2412: 4717	 2417: 69	 2422: 57	 2427: 32	
 2432: 45	 2437: 6273	 2442: 44	 2447: 57	
 2452: 78	 2457: 35	 2462: 5387	 2467: 16	
 2472: 16

remarks:
The stats does not distinguish between APs and CLIENTs. It only counts packets received on that channel.

5 GHz (and higher) highly depend on your wireless regulatory domain setting (especially of RADAR detection is enabled).
If your targeting CLIENTs, you don't have to take care about this, because a > 5GHz CLIENT will try to connect to hcxdumptool on 2.4GHz (the impact of good IE-TAGS in some management frames is huge).

[ZerBea]

Common ESSIDs:
https://www.wigle.net/stats#ssidstats

[vertexgamer]

thx