如何在扫描接入点时监控WiFi信道及站模式下信道收发时序

Alright, let's walk through exactly how you can track your WiFi module's channel-specific transmit/receive behavior during AP scans (both passive and active) when it's operating in infrastructure mode—no need to care about whether it's associated with an AP or not.

To get precise, timestamped data on channel activity during scans, you'll need a mix of packet capture tools and module debugging interfaces. Here's a step-by-step breakdown:

一、Tool Setup #

• Packet Capture Tools: Use tcpdump (with WiFi monitor mode support) or Wireshark paired with a wireless card that supports monitor mode. You must switch your card to monitor mode first to capture frames across all channels, not just the one your device might be connected to.
  • Linux command to enable monitor mode: iw dev wlan0 set type monitor, then restart the interface: ip link set wlan0 down && ip link set wlan0 up
• Module Debugging Tools: For embedded WiFi modules (like ESP32 or Broadcom chips), use the manufacturer's serial debug tools or enable verbose logging in the SDK. This will give you direct access to internal events like channel switches and frame timestamps.

二、Passive Scan Behavior Tracking #

During passive scans, the module hops between channels and listens for Beacon Frames:

• Channel Dwell Time: Compare timestamps in your packet capture (first vs. last Beacon Frame on a channel) to calculate how long the module stayed there. Even better: debug logs will often explicitly show "switched to channel X" and "left channel X" timestamps for pinpoint accuracy.
• Beacon Frame Receive Time: In Wireshark, the frame.time field for each Beacon Frame gives you the exact moment the frame was received.
• Note: Passive scans don't involve the module sending any frames—you only need to listen for incoming Beacons.

三、Active Scan Behavior Tracking #

Active scans involve the module switching channels, sending Probe Requests, and waiting for Probe Responses:

• Channel Dwell Time: Use debug logs to track the time between "switched to channel X" and either "received Probe Response" or "switched to next channel". In packet captures, calculate the time between the first Probe Request and last Probe Response (or the last frame before the module hops channels).
• Probe Request Transmit Time: Check the frame.time field of the Probe Request frame in your capture, or look for explicit "sent Probe Request" timestamps in debug logs.
• Probe Response Receive Time: Same as above—use the frame.time field of the Probe Response frame or debug log timestamps.

四、Key Data Extraction Tips #

• Use Wireshark filters to quickly isolate relevant frames:
  • Filter Beacon Frames: wlan.fc.type_subtype == 0x08
  • Filter Probe Requests: wlan.fc.type_subtype == 0x04
  • Filter Probe Responses: wlan.fc.type_subtype == 0x05
• Export capture data to CSV, then use Excel or a Python script to analyze timestamps, calculate channel dwell times, and frame intervals.
• For embedded modules, enable verbose logging (e.g., ESP32's CONFIG_WIFI_LOG_LEVEL_VERBOSE). Logs will include events like wifi: sta start scan, wifi: switch to channel X, wifi: send probe req, and wifi: recv probe resp—all with timestamps you can directly extract.

五、Important Notes #

• Make sure your wireless card supports monitor mode—otherwise, you won't capture frames from non-current channels.
• Some modules optimize scans (e.g., skipping weak-signal channels), so debug logs will always give a more accurate picture of actual behavior than packet captures alone.
• Sync the clock of your capture device and the WiFi module to avoid timestamp discrepancies.

内容的提问来源于stack exchange，提问作者oh.dae.su