Layer 2 Liberation: Things Your AP Never Dreamed Of
Allan Riordan Ball demonstrates bypassing SSIDs, handshakes, and IP stacks to sling raw 802.11 frames with Scapy as a peer-to-peer data transport pipe.
Summary
Bypassing Higher Network Layers
Allan Riordan Ball explores subverting the traditional Wi-Fi model by stripping away SSIDs, authentication handshakes, and IP routing to treat 802.11 strictly as a blank RF data pipe.
Crafting Raw 802.11 Frames with Scapy
Using Python and Scapy alongside standard USB Wi-Fi adapters in monitor and injection modes, Ball constructs custom management and action frames capable of arbitrary data payload delivery.
Practical Point-to-Point Wireless Hacks
The presentation demonstrates practical wireless hacks including ad-hoc file transfers, covert signaling, and beacon stuffing without requiring an intervening access point.
Detection and Defensive Implications
Because raw frame transmissions bypass typical firewalling and connection logging, detecting non-standard layer 2 traffic requires specialized RF monitoring and frame-level anomaly detection.
Related talks
Wireless Village·33 min
wytshadow
Demonstrates mobile wardriving rigs combining dual-constellation GPS and GLONASS positioning for high-accuracy RF mapping.
Main Track 1·19 min
Denton Gentry
Extracts granular device models and hardware revisions by passive fingerprinting of 802.11 Wi-Fi management frames and probe request signatures.
RF Village·43 min
Exploding Lemur
Breaks down radio frequency fundamentals, antenna physics, filters, Shannon-Nyquist modulation theories, and Software-Defined Radio architectures for beginners.