Is it possible to gain access to 802.11 action frames TX/RX from software? There's a proprietary protocol based on vendor-specific action frames called ESP-NOW for ESP8266 and ESP32 chips, and I'd like to try to implement it on a Raspberry Pi.

It began with my private project where I connected Raspberry Pi with ESP8266 (to exchange short messages), then I've noticed there are additional APIs for ESP8266 (ESP-NOW and Simple Pair) and wanted to compare the performance to ordinary WiFi connection.

If my search for details on accessing WiFi Action frames succeeds, I will post any results (perhaps a library for use in other applications).

  • ESP-NOW resources from Expresif with a PDF User Guide and SDKs looks to be available at espressif.com/en/products/software/esp-now/resources with User Guide saying "ESP-NOW applies the IEEE802.11 Action Vendor frame technology, along with the IE function developed by Espressif, and CCMP encryption technology . . ." Dec 3, 2017 at 15:59
  • @RichardChambers yes, but is it possible in software to receive these IEEE802.11 Action Vendor frames in other devices, i.e. in Raspberry Pi or other WiFi-enabled devices? Dec 4, 2017 at 9:33
  • Yes as Action Vendor frames look to be standard network node level frames which are sent between the nodes of a network at the data link layer with a brief description of what they are for at 802.11 - Action Frames as well as Linux Wireless Networking: a short walk and these stackoverflow postings stackoverflow.com/questions/tagged/… Dec 4, 2017 at 12:54
  • The question is what is the end product you want to provide? Are you wanting to develop a library for others to use in their applications or what? Please update your question with more details about what you hope to accomplish in terms of a specific product outcome of this work. I am not familiar with this level of network communication. I hope someone else can provide more concrete specifics as to how that is done. Dec 4, 2017 at 12:59
  • @RichardChambers done. Dec 5, 2017 at 13:29

3 Answers 3


I'll bet ESP-Now frames can be sniffed by tshark using something like tshark -n -l -i wlp0s29u1u2 -I -y IEEE802_11_RADIO (add a -t type such as ek or json), then add a filter like -Y 'wlan.fc.type_subtype eq 4' to find the packets you want.

You can use any wireless-aware packet injection tool to send WiFi packets. (i.e. Scapy)


This depends on the WiFi adapter you are using; some grant this level of access, others do not, or at least not in any documented or discovered way.

Given that the ESP-series modules are comparable in price to USB WiFi adapters and without the concern of a vendor changing the internals without changing the part number, if you don't need other networking or want to keep this task separate, you could just use one as an air interface for your other embedded system. Delegating the job to an ESP chip might be easier than re-implementing it anyway.


I'm not quite sure what you mean with "access [them] from software", but there is an ESP-NOW implementation for Raspberry Pi here.

Also, if you take your WiFi adapter into monitor mode (on Windows by running %WINDIR%\system32\Npcap\WlanHelper.exe) and tick the "Monitor Mode" checkbox in Wireshark's Capture Options, you can look at the messages:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.