1

Being completely unknowledgeable in the following, I am trying to scan wifi networks in linux. The best I could find was iwlist from wireless tools, but I came across some remarks (one) stating that wireless tools is obsolete and wpa_supplicant should be used instead.

iwlist scanning option fitted my needs. How do I query wireless networks using wpa_supplicant, in a similar fashion ? The docs say you need to define a .conf file, but as far as I understand you define beforehand the networks (ssids) you are interested in scanning/working with - which is not what I am after.

Can wpa_supplicant be used to do a similar job as iwlist scanning, out of the box ?

Improve this question

1 Answer 1

Reset to default
3

stating that wireless tools is obsolete and wpa_supplicant should be used instead.

Well, iwlist is indeed obsolete, but it has been replaced by iw. You can use iw wlan0 scan dump to show the existing scan, and iw wlan0 scan to trigger a new scan.

Can wpa_supplicant be used to do a similar job as iwlist scanning

You can use wpa_cli and then issue scan to do a scan, and scan_results to see the results.

However, wpa_supplicant is one level above iw; it is mainly for authentication. That you can also do scans is more a side issue.

Also have a look at aerodump-ng if you want to do WLAN scanning (this tool doesn't use the inbuilt scan functionality, but does its own channel hopping, and also identifies clients, not only APs).

the whole story starts in the desire to read AP beacons in linux

If that's your ultimate goal (and you should have mentioned this in the question. Please also read up on XY questions), then the simplest way is to put the interface into monitor mode, and read the AP beacons. All internal scans will give you the stored results of the received beacons, and not the beacons themselves.

You can try this out with Wireshark, see e.g. here (first google result), and then use it in your own programs, if so desired.

Improve this answer
5
  • Thanks a lot for the guidance. What do you mean by "not only access points, but also clients" ? What is the meaning of identifying a client in a wlan scan ? I could know all MACs connected to the given AP/SSID/BSSID ?
    – Veverke
    Aug 24, 2021 at 21:18
  • What you can see with iw are the internal driver/firmware lists, which means all APs in range when the interface is in client mode, and all connected clients when the interface is in AP mode. Aircrack-ng is a hacking tool that doesn't use those internal lists, but reads all transmitted data by putting the interface into monitor mode. So you will catch all MACs transmitting something, whether it's AP beacons, are actual traffic. This is typically a subset of all clients. You will also catch clients looking for hidden APs.
    – dirkt
    Aug 25, 2021 at 5:26
  • Thanks a lot for the prompt and detailed help. Highly appreciated. I posted several questions in the last 24 hours, all ultimately resulting from this, and me trying to figure out alternatives/how to overcome it. I will take a look at Aircrack-ng, indeed, the whole story starts in the desire to read AP beacons in linux, and iwlist scanning looked the most adequate option.
    – Veverke
    Aug 25, 2021 at 8:19
  • As a follow up, the best I got so far with iw was running iw dev [my wlan interface name] scan dump -v (tried iw station dump command as well, to no avail). I am looking at iw's source , and it looks it does not use ioctl at all, as opposed to iwlist? This is interesting.
    – Veverke
    Aug 25, 2021 at 9:17
  • Posted this as well, in case you have an answer there as well.
    – Veverke
    Aug 25, 2021 at 20:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .