WiFi Packet Sniffers

• Building sniffer on the basis of ESP32 - Great overview of WiFi packets
  • RFTool
• ESP8266 Technical Reference, 14.1. Sniffer Introduction

There are a few projects out there that use the ESP8266 and ESP32 for packet sniffing. These are the results of a quick search.

• WiFiPcap Stream WiFi packets encapsulated with PCAP to Wireshark. Uses the WiFi Promiscuous feature of the ESP32-S3 to capture and stream PCAP encapsulated packets to Wireshark through the USB CDC interface.
  • My contribution to the list. Builds as an Arduino-ESP32 sketch.
• simple_sniffer - Espressif ESP32 example. Not sure I can build it. pcap.h appears to be missing. Still may be a good reference.
  • pcap.h moved to idf-extra-components
• ESPProLib - ESP8266 Promiscuous Library by Ricardo Oliveira
  • FriendDetector by Ricardo Oliveira
  • FriendDetector, Blog - Detect When a Device Is Nearby with the ESP8266 Friend Detector
  • ESP-Bug appears to build on FriendDetector switches on/off of Sniffer mode so it can POST to PHP server.
• ESP8266 Sniffer, Update to Ray Burnette's Sniffer
• Stale - ArduinoPcap, Youtube - Hint toward the ESP32 maybe having more complete packets. Interfaces to WireShark via serial.
• PacketMonitor32 This one may be useful for WiFi congestion monitoring. However, this is not a pined project and the author does not appear attentive to inquiries. The hardware used may be unavailable. Needs some work to find libraries to support and port to the available hardware. The last update was 5 years ago. TODO: Look for a fork that is being maintained.
  • completed port to LilyGo T-Display
• esp8266-simple-sniffer, Blog
• 016_wifi_sniffer, Blog
• esp8266-sniffer
• ESP32 WiFi Sniffer - MetalFace's Blog: Part 1 and Part 2

Other references

• Espressif's Non-OS SDK - 3.11. Sniffer Related APIs
• Identifying Channel Saturation in Wi-Fi Networks via Passive Monitoring of IEEE 802.11 Beacon Jitter
• 802.11 Beacon Frame
• ieee802_11_defs.h from wpa_supplicant has a lot of useful defines.