Implementing 802.11 probe request scanner using WARP platform

Active service discovery in 802.11 requires the WLAN clients to broadcast the probe request frame based on its' list of preferred networks while searching for Access Point (AP) prior to authentication and association. The Medium Access Control (MAC) address, a unique identifier allocated to a network interface, is embedded in the probe request frame. Coupling with his or her personally identifiable information (PII), such as user profile on the social network, the MAC address can be used for user location tracking. Sniffing the probe request frame requires Wi-Fi chipsets to be configured as promiscuous mode or monitor mode. Unfortunately, not all Wi-Fi chipset supports the promiscuous mode. At the same time, it is rather difficult to find an embedded system with multiple antennas attached to multiple Radio Frequency (RF) interfaces that could allow us to sniff the probe request frame coming from different direction. By utilizing the Wireless Open Access Research Platform (WARP) platform with Mango 802.11 reference design and its Python experiments framework, we have successfully implemented a 802.11 probe request scanner. This platform provides us up to 4 radios with 4 antennas for our sniffing purpose using the two onboard radios and also two additional FPGA Mezzanine Card (FMC) radios.