Candela Technologies Logo
Network Testing and Emulation Solutions

6GHz Packet Capture

Goal: 6GHz Packet Capture Using LANforge Radios in Monitor Mode.

Depending on the NIC, there are different steps required in order to capture on 6GHz frequencies.
Intel AX210/BE200 - Require a station on the parent interface to scan and determine that it is in a US regulatory domain before a monitor mode interface can be assigned a 6GHz frequency.
Mediatek 7921/7922 - No regulatory domain restriction at this time.
  1. Clone and get latest copy of lanforge-scripts.
    1. cd /home/lanforge
    2. git clone
    3. cd /home/lanforge/lanforge-scripts/py-scripts
  2. Run script.
    1. Run the script with the --help argument to understand your options or pip install any missing modules as needed.

      [root@ibase-i5-f36 py-scripts]# ./ --help
      usage: ./
      --mgr localhost
      --mgr_port 8080
      --radio wiphy0
      --outfile /home/lanforge/test_sniff.pcap
      --duration 1
      --channel 36
      --channel_bw 40
      --center_freq 5190
      --radio_mode AUTO
      --monitor_name Sniffer0

      AX210 sniff command

      --mgr_port 8080
      --radio wiphy7
      --outfile /home/lanforge/sniff_6G_80.pcap
      --duration 20
      //--channel 1e
      --channel_bw 80
      --channel_freq 5955
      --center_freq 5985
      --radio_mode AUTO
      --monitor_name SNIFF_6G_80
      --disable_ht40 0
      --disable_ht80 0
      --ht160_enable 0
      --num_stations 1
      --security wpa2
      --ssid axe11000_5g
      --password lf_axe11000_5g
      --ax210_scan_time 10

      This script will sniff a Radio following modifications to its settings. will create a monitor and be able to capture wireshark pcap files:

      The monitor also uses iw commands to set up the proper bw and frequency to be monitored


      iw [options] dev set freq [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz]
      dev set freq [5|10|20|40|80|80+80|160] [ []]

      Example to monitor channel 36 (5180)
      sudo iw dev set freq 5180 40 5190

      for bw of 20 do not need to set the control frequency

      Verify the configuration with :(need to do sudo)
      iw dev info

      [lanforge@ct523c-3ba3 ~]$ sudo iw dev SNIFF_5G_40 info
      [sudo] password for lanforge:
      Interface SNIFF_5G_40
      ifindex 49
      wdev 0x2
      addr d8:f8:83:36:4c:a0
      type monitor
      wiphy 0
      channel 36 (5180 MHz), width: 20 MHz, center1: 5180 MHz
      txpower 0.00 dBm
      [lanforge@ct523c-3ba3 ~]$

      Help: 5Ghz frequencies

      Tested on 02/16/2023:
      kernel version: 5.19.17+
      gui version: 5.4.6
      the script modified a radio and created a pcap file as expected when ran directly on a lanforge system (ct523c & ct521a).

      -h, --help show this help message and exit
      --mgr MGR --mgr: IP Address of LANforge
      --mgr_port MGR_PORT --mgr_port: HTTP Port of LANforge
      --radio RADIO --radio: Radio to sniff
      --outfile OUTFILE --outfile: give the filename with path
      --duration DURATION --duration duration in sec, for which you want to capture
      --channel CHANNEL
      --channel Set channel pn selected Radio, the channel [52, 56 ...]
      channel will get converted to the control frequency.
      Must enter Channel

      --channel_freq CHANNEL_FREQ

      --channel_freq this is the frequency that the channel operates at
      Must enter --channel or --channel_freq
      --channel_freq takes presidence if both entered if value not zero

      --channel_bw CHANNEL_BW
      --channel_bw select the bandwidth to be monitored, [ [20|40|80|80+80|160]], default=20
      --center_freq CENTER_FREQ

      --center_freq select the bandwidth to be monitored, not needed if bw is 20

      --radio_mode RADIO_MODE
      --radio_mode select the radio mode [AUTO, 802.11a, 802.11b, 802.11ab ...]
      --monitor_name MONITOR_NAME
      Wi-Fi monitor name
      --disable_ht40 DISABLE_HT40
      Enable/Disable "disable_ht40" [0-disable,1-enable]
      --disable_ht80 DISABLE_HT80
      Enable/Disable "disable_ht80" [0-disable,1-enable]
      --ht160_enable HT160_ENABLE
      Enable/Disable "ht160_enable" [0-disable,1-enable]"
      --ax210 --ax210 will create a station on the ax210 to get the regulatory domain for 6g and admin down the station then create the monitor for 6g on the AX210 radio
      --number_template NUMBER_TEMPLATE
      Start the station numbering with a particular number. Default is 0000
      --station_list STATION_LIST [STATION_LIST ...]
      Optional: User defined station names, can be a comma or space separated list
      --upstream_port UPSTREAM_PORT
      --upstream_port upstream port default: eth2
      --side_a_min_rate SIDE_A_MIN_RATE
      --side_a_min_rate bps rate minimum for side_a default: 1024000
      --side_b_min_rate SIDE_B_MIN_RATE
      --side_b_min_rate bps rate minimum for side_b default: 1024000
      --security SECURITY WiFi Security protocol: < open | wep | wpa | wpa2 | wpa3 >
      --ssid SSID WiFi SSID for script objects to associate to
      --password PASSWORD WiFi passphrase/password/key
      --mode MODE Used to force mode of stations default: 0 (auto)
      --num_stations NUM_STATIONS
      Number of stations to create
      --ax210_scan_time AX210_SCAN_TIME
      Time to wait for scan
      --ap AP Used to force a connection to a particular AP
      --log_level LOG_LEVEL
      Set logging level: debug | info | warning | error | critical
      --lf_logger_config_json LF_LOGGER_CONFIG_JSON
      --lf_logger_config_json , json configuration of logger
      --sniff_bytes SNIFF_BYTES
      keep this many bytes per packet, helps to reduce overall capture size
      --sniff_using SNIFF_USING
      Default sniffer is wireshark, which is only useful from a desktop setting.
      Combine options with a comma: dumpcap,mate_xterm
      tshark: headless tshark utility
      dumpcap: headless dumpcap utility
      mate_terminal: make tshark/dumpcap interactive in a MATE terminal
      mate_xterm: make tshark/dumpcap interactive in an xterm
      mate_kill_dumpcap: kill previously issued dumpcap will create a monitor on LANforge (cli command add_monitor)
    2. Run the script with arguments for your test case.
      To sniff on 6GHz with an AX210 NIC on resource 1, wiphy2:
      ./ --mgr --radio "1.wiphy2" \
      --outfile sniff_6G-AX210.pcapng --duration 10 --channel 37e --ax210 \
      --num_stations 1 --ssid test --ax210_scan_time 20

      To sniff on 6GHz with an MTK7921/MTK7922 NIC on resource 6, wiphy0:
      ./ --mgr --radio "6.wiphy0" \
      --outfile sniff_6G-MTK.pcapng --duration 10 --channel 133e
    3. For more information, see this guide: sniffer_manual.pdf

Candela  Technologies, 2417 Main Street, Suite 201, Ferndale, WA 98248, USA | | +1.360.380.1618
Facebook | LinkedIn | Blog