[Python] Scapy Raw layer in data frame is missing initial 3 characters of load and shortened...

I am using Scapy to learn about Wi-Fi. I am new to both Scapy and Wi-Fi.

I have a Raspberry Pi 5 and a laptop, running Debian GNU/Linux 12 (Bookworm) and Ubuntu 22.04.1 LTS, respectively, and an ALFA AWUS036AXML Wi-Fi adapter set in monitor mode connected to each. I am using IPython and Scapy to interact with the Wi-Fi adapters.

I can create Beacon packets (using Scapy) on either device and sniff them successfully on the other device, so I think my basic setup is correct.

However, when I try to send a data packet with text in a raw layer, the first 3 characters of the load are dropped and the shortened load is printed many times by the receiver.

Creating a data packet like so (where addr1 below is the actual MAC of the unit I'm sending to):

import scapy.all as scapy
from scapy.layers.dot11 import Dot11, Dot11Beacon, Dot11ProbeReq, Dot11Elt

packet = scapy.RadioTap() / scapy.Dot11(type=2, subtype=0, addr1="00:c0:ca:b7:2e:7c", addr2="00:11:22:33:44:55", addr3="00:11:22:33:44:55") / scapy.Raw(load="Hello World!")


I can check packet.show()

###[ RadioTap ]###
version = 0
pad = 0
len = None
present = None
notdecoded= b''
###[ 802.11 ]###
subtype = Data
type = Data
proto = 0
FCfield =
ID = 0
addr1 = 00:c0:ca:b7:2e:7c (RA=DA)
addr2 = 00:11:22:33:44:55 (TA=SA)
addr3 = 00:11:22:33:44:55 (BSSID)
SC = 0
###[ Raw ]###
load = b'Hello World!'


and

if packet.haslayer("Raw"):
print(packet["Raw"].load.decode("utf-8"))


gives

Hello World!


I send the packet using

scapy.sendp(packet, iface="wlan1")


where "wlan1" is the the ALFA adapter on the transmitter.

On the receiving machine, my sniffer function is

def sniff_callback(packet):
if packet.haslayer("Dot11"):
if packet.getlayer("Dot11").addr1 == "00:c0:ca:b7:2e:7c":
if packet.haslayer("Raw"):
print(packet["Raw"].load.decode("utf-8"))
return


and I run it with

scapy.sniff(iface="wlan", prn=sniff_callback)


where "wlan" is the ALFA adapter on the receiver.

The output by the receiver when the transmitted packet is received is

lo World!
lo World!
lo World!
lo World!
lo World!
lo World!
lo World!
lo World!
lo World!
lo World!
lo World!
lo World!
lo World!
lo World!
lo World!


So, the initial 3 characters are dropped, and it is printed 15 times. If I add 3 spaces to the beginning of the load (" Hello World!"), I get "Hello World!" printed 15 times.

I think there is a mistake in my packet definition, but I don't know what's wrong.

Continue reading...