Broadcasting wifi packets without a network

Question

I have a question about Wifi, I couldn't find the answer anywhere.

Is it possible to send a packet over wifi without having joined any kind of network (ad-hoc or not)?

I would like to be able to send packets in the air without joining a network. Another device in monitor mode would be able to recognize which packets it should treat. I know wifi may not be the best way to do this, just wanted to know how it works technically.

Indeed, there must be some kind of packets sent during wireless network discovery? How are the various SSIDs transferred over network without a connection being made? What kind of packets are sent to discover networks over wifi?

If someone could just point me in the direction of some documentation about this, I couldn't find it.

Thanks a lot!

Answer 1

The short answer is yes, it is not only possible, but happens all the time. Examples of this are CTS-to-self, beacons (sent by APs), probe requests, probe responses and a number of other management types of frames.

However, it seems that isn't exactly what you mean and are looking for a way to transmit data from one device to another without any sort of established relationship. The only software I know of that transmits data in this fashion are tools used when penetration testing wireless security.

Generally, these work by replaying data captures back into the air. Instead of replaying captured traffic, you could craft your own 802.11 frames into a "capture" file and replay any data you wanted. Your second station in monitor mode could then capture the traffic out of the air.

Do keep in mind that this would be a very rudimentary form of wireless communication and does not provide any mechanism for retries/retransmissions (recovery from collisions or other interference) or a means of encryption (unless you encrypt the data before creating your frames).

Answer 2

You talk about needing to join a network beforehand, and mention ad-hoc networks. However joining a IBSS (ad-hoc network) entails nothing more than setting the BSSID of the packets that you are going to send on the network, no packets have to be sent when "joining" an IBSS network.

So you could just join any IBSS network and start sending frames to the broadcast MAC address on the appropriate Wi-Fi interface.

These packets would be transmitted on that interface with the BSSID that you set when "joining" the network, and could be captured by any other Wi-Fi device on the same channel in monitor mode.