ESP32 – WiFi sniffer

47 thoughts on “ESP32 – WiFi sniffer”

1. The code compiles on Arduino IDE 1.8.19 with some WARNINGS regarding deprecated code.
   This should fix all WARNINGS:

   CHANGE
   tcpip_adapter_init();
   TO
   esp_netif_init();

   CHANGE
   ESP_ERROR_CHECK( esp_event_loop_init(event_handler, NULL) );
   TO
   ESP_ERROR_CHECK(esp_event_loop_create_default());

   • Thanks for this hint.
     /LP

2. Hi Łukasz,

   I have a question regarding the reported RSSI value. Does it refer to the RSS of the sniffed packet at the sniffer module (i.e., ESP32), or it is between the actual source and destination (e.g., my phone and home router)?

   Best regards,
   Reza

   • Hi, RSSI (Received Signal Strength Indication) is an indicator in dBm scale and describes the signal strength received on ESP32 antenna. So, the signal strength between some device and ESP32.

3. If in the middle of running I want to use WiFi.scanNetworks(); How can I do that and after that return sniffing?

   I think I need

   WiFi.mode(WIFI_STA);
   WiFi.disconnect();

   But how can I do that and after that return sniffing???

4. Hi, how can I filter the MAC addresses to find out how many devices are in the proximity?? Kindly help!!!!

   • I have done it in this code (just the Arduino version),
     Instead of parsing the data in Arduino, I’m doing it in Python.
     If you want to take a look and if other people who’s interested, you can check it out the program I made https://github.com/KushMax/Analyzing-Data-from-USB-port

5. Ciao, c’è modo di stampare anche SSID nel monitor seriale

6. Anyone know how to also get the SSID from the payload? I can see it in loads of ESP8266 based codes but nothing for the ESP32. Thanks.

7. Awesome thanks Łukasz. I have been trying to find a way to conserve power on an ESP that is being set up in a remote location. If the researchers turn up on site to download the logs the system can then spin up the WiFi for them otherwise the system returns to its sleep mode as per its normal cycle.
   It looks like this will be perfect if i set it up on the second core, while the data is being collected from the sensors and stored to the flash on the first core the second can passively scan if there is a client nearby and if there is fire up the WiFi/Web interface.

   There is not likely to be any other devices in close proximity given the site is way down in Antarctica on the side of Mt Erebus so I may not even need to compare known mac addresses.

   • Hi Andrew, I find it as a kind of wow-project 🙂 Will you share it? A photo at least?
     /L

8. Hi Lukasz,

   Can you advise me how to find as quickly as possible the MAC addresses of surround WiFi Accesspoints please?

   Thanks,

   Wim

9. Very nice!!! How to compare MAC address of the friends or clients with the nearby MACs?

10. Hi Lukasz, I know this is a couple years after the post but was hoping you still check comments. I’m currently looking into parts that can be used as a wifi/bluetooth packet sniffer. I know someone who used an ESP8266 for sniffing WiFi packets, but he said it didn’t work with newer cellular devices because it only supports modulation schemes up to MCS7. I assume the ESP32 is compatible with modern devices, but would like your input. I thought about using a CC2640+CC3100, but a fully integrated BLE+WiFi SOC would be ideal, especially since there is no existing host driver for interfacing the CC2640+CC3100. Any ideas?

    • Hi Alec, I always recommend ESP32 for small packets sniffer but it also has some limitations like: sniffing one channel at a time or support only 2.4GHz band. I didn’t use CC2640+CC3100 chips but looks quite good. Probably on “clear” ARM it will be more challenging to create such packet sniffier than on ESP32. Anyway, if you’re planning to design something that will be a product / production ready then I would recommend to use dedicated/existing AP hardware (with for example OpenWRT) that supports 2.4/5 GHz and write some code (User space or Kernel space – using i.e. Netfilter hooks) to capture packets.
      /L

11. Hi, can you please answer the following question:

    I have two cell phones with wifi enabled and they don’t connected to any network. I know their MAC addresses so I expect to see them in the output results, but I don’t see them. Instead I see a lot of other MAC addresses that belong to Tp-Link, D-link and some other network vendors. I guess that all these addresses belong to routers or some other access points. Why could this happen? Why I don’t see mu devices but I see routers? Thanks.

    • Hi Andrey, you can see AP MACs because they broadcast constantly WiFi beacon frames. Client devices which are not connected to any AP also can broadcast beacon requests while performing active scanning. It happens frequently (ones per X minutes or on demand) but it depends on client-side configuration. Try to dig some info about WiFi beacons.
      /L

12. Hi Łukasz, I am playing with Your sniffer. It’s really great ! Please correct my humble thinking – could I possible use it to sniff and extract data packets of my PV (photovoltaic inverter)? It has a wifi card (client of known password, IP,# port# ) and sends PV data every 5 mins to the server-portal. I want to make a nice small-box sniffer based on ESP8266 or ESP32 with ability of:
    – sniff and extract data packet of PV
    – decode PV data packet (I have some idea how)
    – sent mqtt packets to my home mini BMS (I have some idea how)
    Please kindly give advice and directions for a beginner.
    Regards, Paweł

    • Hi Paweł, generally – it should work but note that you can capture/decode packets only if your PV inverter produces not encrypted data. It would be easier to start with some packet analyzer (i.e. WireShark). Try to capture some packets and analyze the content before you dive into ESP32. It will give you information about payload structure. This information will be useful to create proper packet filter and payload parser. Good luck!
      /LP

13. Hi Lukasz,
    I have a few questions:

    I am trying to figure out what the “payload” returns? like how do you know what the types and values are for “wifi_ieee80211_mac_hdr_t”?

    What do you mean with?
    /* receiver address */
    /* sender address */
    /* filtering address */

    • Hi Fadi,
      The structure “wifi_ieee80211_mac_hdr_t” reflects WLAN MAC Frame. Well, some of network/wifi libraries have closed sources but let the tip be that ESP-IDF has adopted a FreeBSD WiFi stack (et80211/ieee80211, http://www.unix.com/man-page/freebsd/9/NET80211).

      /L

14. hi Łukasz,
    I would like to sniff “PROBE” packets. How to do it?
    Thank you in advance

15. Is your wifi sniffer code able to detect AP_PROBEREQRECVED ?
    A list of STA devices around the ESP32 in AP mode.

16. Hi, code has been updated.
    /L

17. Hi, seems like all that issues with “undefinds” points to the same fact – switching to newest version of ESP-IDF. I’ll update the example code to support current version of ESP-IDF.

18. Hi, I’m having a similar issue to the above – though I am using an ESP32thing breakout and arduino IDE with espressif (I believe this is slightly different from what you are doing). I get the errors:

    from C:\Program Files (x86)\Arduino\hardware\espressif\esp32/tools/sdk/include/esp32/esp_system.h:20:0,

    from C:\Program Files (x86)\Arduino\hardware\espressif\esp32/tools/sdk/include/freertos/freertos/portable.h:126,

    from C:\Program Files (x86)\Arduino\hardware\espressif\esp32/tools/sdk/include/freertos/freertos/FreeRTOS.h:105,

    from C:\Program Files (x86)\Arduino\hardware\espressif\esp32\cores\esp32/Arduino.h:32,

    from sketch\sketch_dec08a.ino.cpp:1:

    C:\Users\Ancient Abysswalker\Documents\Arduino\Projects\Project Arianna\ESP Sniff Testing\sketch_dec08a\sketch_dec08a.ino: In function ‘void wifi_sniffer_init()’:

    sketch_dec08a:76: error: ‘WIFI_COUNTRY_EU’ was not declared in this scope

    ESP_ERROR_CHECK( esp_wifi_set_country(WIFI_COUNTRY_EU) );

    ^

    C:\Program Files (x86)\Arduino\hardware\espressif\esp32/tools/sdk/include/esp32/esp_err.h:72:25: note: in definition of macro ‘ESP_ERROR_CHECK’

    esp_err_t rc = (x); \

    ^

    C:\Users\Ancient Abysswalker\Documents\Arduino\Projects\Project Arianna\ESP Sniff Testing\sketch_dec08a\sketch_dec08a.ino: In function ‘const char* wifi_sniffer_packet_type2str(wifi_promiscuous_pkt_type_t)’:

    sketch_dec08a:95: error: ‘WIFI_PKT_CTRL’ was not declared in this scope

    case WIFI_PKT_CTRL: return “CTRL”;

    ^

    exit status 1
    ‘WIFI_COUNTRY_EU’ was not declared in this scope

    …The format is slightly different, but still based off C, with a main loop and some initialization code. I should be able to port it, but I believe there is a missing library? Perhaps “freertos”?

    • I changed the code so that the line is now

      esp_err_t esp_wifi_set_country(const wifi_country_t *USA);

      That makes sense. case wifi_pkt_rx_ctrl: return “CTRL”; is still invalid though, and I can’t seem to determine what they’ve changed it to in the new documentation document…

      • Just realized how stupid that was to do that… It appears that wifi_country_t and the packet types are undefined and as such I cannot call things like WIFI_COUNTRY_US or WIFI_PKT_CTRL? Odd

19. Hi Lukasz,
    I am running the same problem like Defozo, but you do not explain how to solve it? is there an update to the .h files?
    Thx!

20. I’m standing in the rain. When compiling with the Arduino IDE, the same problems are reported. Also with the answer from Lukasz, I do not know what have to be changed. Maybe Lukasz or Defozo is able to tell me, what has to be done to get it work. Thanks a lot in advance.

21. In file included from F:/esp32/esp-idf/components/esp32/include/esp_system.h:20:0,
    from F:/esp32/esp-idf/components/freertos/include/freertos/portable.h:126,
    from F:/esp32/esp-idf/components/freertos/include/freertos/FreeRTOS.h:105,
    from F:/esp32/blog-master/esp32/016_wifi_sniffer/main/main.c:7:
    F:/esp32/blog-master/esp32/016_wifi_sniffer/main/main.c: In function ‘wifi_sniffer_init’:
    F:/esp32/blog-master/esp32/016_wifi_sniffer/main/main.c:76:40: error: ‘WIFI_COUNTRY_EU’ undeclared (first use in this function)
    ESP_ERROR_CHECK( esp_wifi_set_country(WIFI_COUNTRY_EU) );
    ^
    F:/esp32/esp-idf/components/esp32/include/esp_err.h:72:25: note: in definition of macro ‘ESP_ERROR_CHECK’
    esp_err_t rc = (x); \
    ^
    F:/esp32/blog-master/esp32/016_wifi_sniffer/main/main.c:76:40: note: each undeclared identifier is reported only once for each function it appears in
    ESP_ERROR_CHECK( esp_wifi_set_country(WIFI_COUNTRY_EU) );
    ^
    F:/esp32/esp-idf/components/esp32/include/esp_err.h:72:25: note: in definition of macro ‘ESP_ERROR_CHECK’
    esp_err_t rc = (x); \
    ^
    F:/esp32/blog-master/esp32/016_wifi_sniffer/main/main.c: In function ‘wifi_sniffer_packet_type2str’:
    F:/esp32/blog-master/esp32/016_wifi_sniffer/main/main.c:95:7: error: ‘WIFI_PKT_CTRL’ undeclared (first use in this function)
    case WIFI_PKT_CTRL: return “CTRL”;
    ^
    make[1]: *** [/f/esp32/esp-idf/make/component_wrapper.mk:243: main.o] Error 1
    make: *** [F:/esp32/esp-idf/make/project.mk:435: component-main-build] Error 2

    How to fix this?

    • Hi, looks like the compiler says that you have a few undefined’s. I think you’re using newest version of ESP-IDF where arguments passed to these functions has been changed a little, i.e.:

      
/* ref: https://github.com/espressif/esp-idf/blob/3a271a4ae7df8a9049fbbb801feafca5043c31eb/components/esp32/include/esp_wifi_types.h */
typedef struct {
char cc[3]; /* country code string */
uint8_t schan; /* start channel */
uint8_t nchan; /* total channel number */
wifi_country_policy_t policy; /* country policy */
} wifi_country_t;

      /* ref: https://github.com/espressif/esp-idf/blob/79f206be47c3f608615c1de8c491107e6c9194bb/components/esp32/include/esp_wifi.h */
      esp_err_t esp_wifi_set_country(const wifi_country_t *country);

22. I’m going to look at this code this weekend.

    Łukasz, I know the Arduino IDE is a C++ compiler – do you know what I’d need to do to get started converting your program to Arduino IDE? I’m guessing I might need to add some .h files, and alter some function calls?

    I’d be happy if I can drop it straight in!

    • Sarah, I’m quite sure you can do that using Arduino IDE and some Arduino libraries able to manage WiFi settings. Arduino IDE uses low-level functions from ESP-IDF project which I’m using directly in my project. What you need is set WiFi mode to WIFI_MODE_NULL (no AP nor STATION), then turn WiFi into promiscusous mode (sniffing mode) and finally register custom handler able to process raw packets. Packet structure should be the same. Good luck!

23. Hi Łukasz
    Thanks for this example ..is working like charme 🙂
    as i develop this stuff with eclipse/SLOEBER i needed some minor adaption concerning setup() and loop

    uint8_t level = 0, channel = 1;

    // the setup function runs once when you press reset or power the board
    void setup() {
    // initialize digital pin 13 as an output.
    Serial.begin(115200);
    delay(10);
    wifi_sniffer_init();
    gpio_set_direction(LED_GPIO_PIN, GPIO_MODE_OUTPUT);
    }
    // the loop function runs over and over again forever
    void loop() {
    Serial.print(“huhuhuhu”);
    delay(1000); // wait for a second
    gpio_set_level(LED_GPIO_PIN, level ^= 1);
    vTaskDelay(WIFI_CHANNEL_SWITCH_INTERVAL / portTICK_PERIOD_MS);
    wifi_sniffer_set_channel(channel);
    channel = (channel % WIFI_CHANNEL_MAX) + 1;
    }
    ..instead of your void Main loop
    and i needed the #include for this serial out..

    GREAT base now..:-)
    in my last ESP8266 project i combined the promiscuous mode with station-Mode. the module is sniffing the channels..stop..and transfer this data via REST-API to a webServer..( and MS SQL DB ).
    this all in a loop!
    In my 8266 scatch i additionally sniff the SSID..wondering if ESP32 also will be able to get the SSID!?

    now i will digg deeper into your code and bring it hopefully to fly like ESP8266 (promiscuous + Station ).
    Target is then to additionally SNIFF the BLE ( also in promiscuous??) ..this all together will ( hopefully ) give a quite “complete” signature of moving objects 😉

    greets
    kristina

    • Hi, thanks for sharing the code! I’m sure you can find all visible acesspoints by capturing their prob req/resp packets containing all that info, i.e. SSID/BSSID.
      Ps.: I love this line 🙂 Serial.print(“huhuhuhu”);
      Cheers! L

24. It works like a charm, but a change needs to be done in order to compile correctly.

    The line
    case WIFI_PKT_CTRL: return “CTRL”;
    shoud be commented or removed, because the type WIFI_PKT_CTRL is not included in esp_wifi_types.h and this kind of packets don’t have any interesting meaning.

    Thanks Łukasz 🙂

    • You’re welcome! 🙂 Thanks for reply on that. Good hint. I need to verify it again as esp-idf is constantly maintained what is so amazing.

25. I tried your code with latest esp-idf (mid August) but it captures only management packets.

    No way to sniff data packets at all!
    Do you know the reason?

    • It captures management packets due to if-condition inside the function. It imply other packets are just dropped. If you remove that condition then it should capture other packets as well.

26. Have you actually tried to build this and test it? Doesn’t promiscuous mode require the device to be already connected to a network?

    • Why should promiscuous mode need to be connected to a network? Have you read what promicuous mode is and what is it for?

27. does this capture the handshake packets as well? i was under the impression the 8266 dropped them and that was a conscious decision on the makers part. I am currently building a sophisticated pen testing rig (hid capture and clone at a distance, 4s lipo, raspi with soft power switch..etc)and would love to throw one of these on if it can d0 hand shakes

28. Where do you set the ssid and the password of the network? I mean, how does the esp32 know, ‘where’ he has to capture the network traffic?

    • You don’t need to set SSID/password after its been turned into promiscuous mode. This mode allows you to capture all packets from the current WiFi channel of ESP32 module.

29. I try your demo,but it shows fail.

    • Could you provide more info ?