The end goal here s to build a python program with Scapy that detects all access points within range of my machine.


I understand this is normally done by using 802.11 Frame Types, specifically probe request frames and probe responses.


However, I seem to be missing a concept.

With scapy I can send out a probe request frame like so:

local_mac = 'AA:BA:CA:DA:EA:FA'
dest_mac = 'AB:BB:CB:DB:EB:FB'
srp(Dot11(type=0, subtype=4, addr1 = local_mac, addr2 = dest_mac), iface = 'wlan0')

As you can see, I need the destination mac address of the access point I have not discovered yet. So, how should I already know the destination mac address before discovering the access point?

How is this done in other applications that achieve this result -- such as the list of access points that my computer provides for me to possibly connect to?

2 Answers 2


You obviously don't know the AP's MAC address, so you want to send it to everybody. You use the broadcast address FF:FF:FF:FF:FF:FF. Every device will receive this packet, and APs will respond with a probe response.

Listening for beacons is not enough. Often, SSID's are hidden, so you have to actively probe for them.

  • That is something some applications actively do. For the last question, a lot of OSes passively listen for beacons to populate the list of available SSIDs.
    – Ron Maupin
    Jul 20, 2016 at 21:12
  • Would I need two wireless cards for this ... one to monitor and one to transmit?
    – ma77c
    Jul 20, 2016 at 21:16
  • No. You send requests, and then listen for responses.
    – Ron Trunk
    Jul 20, 2016 at 21:17

The way to get the MAC addresses of WAPs is to listen for beacon frames sent by the WAPs.

This is from the link in your question:

Beacon frame: The access point periodically sends a beacon frame to announce its presence and relay information, such as timestamp, SSID, and other parameters regarding the access point to radio NICs that are within range. Radio NICs continually scan all 802.11 radio channels and listen to beacons as the basis for choosing which access point is best to associate with.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.