Help with Packet Injection on Raspberry Pi 3B

[naiith]

I’m working on a project that involves packet injection on a Raspberry Pi 3B. My goal is to send custom packets and verify that they are received by another Raspberry Pi running in monitor mode. However, while I can see the packets being transmitted on the sender side using tcpdump, they are not being received by the other Raspberry Pi.

Setup Details:
Device: Raspberry Pi 3B
OS: Raspberry Pi OS (64-bit)
Nexmon patch installed and utilities built.
Setup interface mon0 like so:
iw dev wlan0 set power_save off
iw phy "$(iw dev wlan0 info | gawk '/wiphy/ {printf "phy" $2}')" interface add mon0 type monitor
ifconfig mon0 up
nexutil -m2
nexutil -k12
This is the same for both devices

Steps I’ve Taken:

Tried to verify monitor mode is working (using tcpdump I'm able to hear (not my) packets on channel 12) also airodump-ng mon0 recieves some packets.
Tried to confirm that packets are being transmitted on the sender side with tcpdump -i mon0 -xx on the sender.
Looks like in theory packets are being sent. When running ifconfig mon0 the TX packets count increases also.
The problem is the device listening does not pick up any packets from the devices sending.
It seems like I can't get the Raspberry Pi 3B to send any packets.

What I’m Trying to Verify:
Whether packets are being physically transmitted.
Why the receiver isn’t capturing these packets despite being in monitor mode.

The ultimate goal is to be able to send and receive custom packets on both devices.
Any advice or insights would be greatly appreciated!

[jlinktu]

• Is the correct channel set? Check back after setting it with nexutil -k. Also make sure nothing is interfering with that, e.g. kill wpa_supplicant.
• Do frames end up in the firmware for injection to the medium? You can add something to the firmware that allows you to check that. E.g. put a printf after

  nexmon/patches/bcm43430a1/7_45_41_46/nexmon/src/injection.c

  Line 98 in ef25ce3

  if (wlc->monitor && p != 0 && p->data != 0 && ((short *) p->data)[0] == 0) {

  . Try to inject a frame and check the console (forensics file in the debug fs) for the expected print. Alternatively to printing you could also define and toggle a variable that you then read out via an IOCTL. If the expected frames don't end up at the position that I linked, you might want to check outside of the respective if condition. If you get hits there, the frames might be malformed. Btw. are you making sure that the injected frames are prepended with a Radiotap header? If not, make sure to do so!.
• Are frames sent out to the medium but not seen by your receiver? Get a different monitor device and use it to check if it can overhear the frames you are looking for. Many Wi-Fi cards built into laptops support monitor mode by default, or you can use one of the many other devices supported by nexmon.
• There are also more sophisticated approaches, e.g. you could check if power is emitted at the antenna when you are expecting a transmission, or you could sample the spectrum in question using an SDR to check if you can find your frames in there.