The end goal here s to build a python program with Scapy that detects all access points within range of my machine.
I understand this is normally done by using 802.11 Frame Types, specifically probe request frames and probe responses.
However, I seem to be missing a concept.
With scapy I can send out a probe request frame like so:
local_mac = 'AA:BA:CA:DA:EA:FA'
dest_mac = 'AB:BB:CB:DB:EB:FB'
srp(Dot11(type=0, subtype=4, addr1 = local_mac, addr2 = dest_mac), iface = 'wlan0')
As you can see, I need the destination mac address of the access point I have not discovered yet. So, how should I already know the destination mac address before discovering the access point?
How is this done in other applications that achieve this result -- such as the list of access points that my computer provides for me to possibly connect to?