Can't send / sniff NDF packet (IDFGH-14417)

[roger-]

Answers checklist.

• I have read the documentation ESP-IDF Programming Guide and the issue is not addressed there.
• I have updated my IDF branch (master or release) to the latest version and checked that the issue is present there.
• I have searched the issue tracker for a similar issue and not found a similar issue.

IDF version.

5.1.5

Espressif SoC revision.

ESP32-S2 (revision v0.0)

Operating System used.

Linux

How did you build your project?

Command line with Make

If you are using Windows, please specify command line type.

None

Development Kit.

ESP32-S2-Saola-1

Power Supply used.

USB

What is the expected behavior?

My goal is to send a null data frame to a device and get the ACK (and examine the CSI ultimately). My ESP-32 is in STA and connected to an AP.

I'm generating a null data frame and transmitting it with esp_wifi_80211_tx(). The destination MAC is another device and I'm setting the source MAC in the frame to a unique MAC (which I use to filter later).

I'm then sniffing and trying to find the ACK from the destination device, but I'm not receiving a response.

It worked in the past with 4.x.

What is the actual behavior?

I don't observe the expected packet.

I get many different ACKs, but none with a destination matching the source MAC.

I don't believe the NDF packets are being transmitted as I don't see them with a sniffer.

Steps to reproduce.

My transmit task looks like this:

    uint8 MAC_ADDR_SRC[6] = {0x00, 0x00, 0x88, 0x88, 0x88, 0x88}; // meant to be invalid
    ieee80211::frame_data_null_t pkt;
    memset(&pkt, 0, sizeof(pkt));
    pkt.frame_control.type = ieee80211::WIFI_FC_DATA;
    pkt.frame_control.subtype = ieee80211::WIFI_NULL;
    pkt.frame_control.to_ds = 1;

    pkt.dest  = MAC_ADDR_DST;
    pkt.src   = MAC_ADDR_SRC;
    pkt.bssid = MAC_ADDR_DST;

    ESP_ERROR_CHECK(esp_wifi_config_80211_tx_rate(WIFI_IF_STA, WIFI_PHY_RATE_24M));

    ESP_LOGE(TAG, "starting NDF ping: %s -> %s", format_macaddr(pkt.src).c_str(),
                                                 format_macaddr(pkt.dest).c_str());

    while(true) {
        ESP_LOGE(TAG, "sending 802.11 NDF ");
        ESP_ERROR_CHECK(esp_wifi_80211_tx(WIFI_IF_STA, (void *)&pkt, sizeof(pkt), true));

        vTaskDelay(this_obj->ping_interval_ms / portTICK_PERIOD_MS);
    }

And my promiscuous setup code:

    wifi_promiscuous_filter_t filter = {
        .filter_mask = WIFI_PROMIS_FILTER_MASK_CTRL 
    };

    wifi_promiscuous_filter_t filter_ctrl = {
        .filter_mask = WIFI_PROMIS_CTRL_FILTER_MASK_ACK
    };

    ESP_ERROR_CHECK(esp_wifi_set_promiscuous_filter(&filter));
    ESP_ERROR_CHECK(esp_wifi_set_promiscuous_ctrl_filter(&filter_ctrl));
    ESP_ERROR_CHECK(esp_wifi_set_promiscuous_rx_cb(&callback_wifi_promiscuous));
    ESP_ERROR_CHECK(esp_wifi_set_promiscuous(true));

And my promiscuous callback:

    wifi_promiscuous_pkt_t *p = (wifi_promiscuous_pkt_t *)buf;
    ieee80211::frame_ctrl_ack_t *frame_ack = (ieee80211::frame_ctrl_ack_t *)(p->payload);

    // check if actually ACK
    if(frame_ack->frame_control.type != ieee80211::WIFI_FC_CTRL || frame_ack->frame_control.subtype != ieee80211::WIFI_ACK) {
        return;
    }

    // see if the destination MAC of the ACK matches the source MAC that we sent
    if(memcmp((void *)&frame_ack->dest, (void *)&MAC_ADDR_SRC, sizeof(ieee80211::mac_address_t)) == 0) {
        ESP_LOGE(TAG, "FOUND ACK"); // never get here
    }

Debug Logs.

No response

More Information.

No response