promisc.h File Reference

Wi-Fi promiscuous (monitor) capture (DETWS_ENABLE_PROMISC) - passive 802.11 sniffing. More...

#include "ServerConfig.h"

Go to the source code of this file.

Detailed Description

Wi-Fi promiscuous (monitor) capture (DETWS_ENABLE_PROMISC) - passive 802.11 sniffing.

A read-only capture path: instead of joining a network and terminating traffic, listen to every 802.11 frame on a channel and hand it to a sink. The canonical wiring feeds the sink into the forwarding plane (services/forward), so captured Wi-Fi frames are bridged to another interface (e.g. Ethernet) for a wired collector - "capture on Wi-Fi, forward to Ethernet".

Two host-testable pieces plus the ESP32 radio binding:

• wifi_frame_parse(): decode the 802.11 MAC header (type/subtype, the to/from-DS address layout -> src / dst / bssid, sequence number, header length). Pure.
• pcap_* : build the classic libpcap global + per-record headers (DLT_IEEE802_11) so a forwarded frame is a valid PCAP stream a wired Wireshark / tcpdump can read. Pure.
• promisc_begin() / _set_channel() / _end(): esp_wifi_set_promiscuous() bring-up whose rx callback copies each frame (with RSSI + channel) to the registered sink. ESP32 only.

Capture is strictly passive (no injection) and fail-closed: the sink is expected to drop, not block, when its downstream is full, so the live data path is never stalled.

Author

Douglas Quigg (dstroy0)

Date

2026

Definition in file promisc.h.