title: How to extract vendor data using scapy from a probe request
body: <p>So this is my script:</p>
  
  <pre><code>#!/usr/bin/env python
  import sys
  from scapy.all import *
  from subprocess import *
  
  call(["clear"])
  
  print "Probe Investigator"
  print "-----------------------------------------------------"
  
  intf = raw_input("Enter the Name of the interface to sniff: ")
  print ("\n")
  clients = []
  uni = 0
  mach = []
  
  def phandle(p):
      if p.haslayer(Dot11ProbeReq):
          mac = p.addr2
          if p.haslayer(Dot11Elt):
              if p.ID == 0:
                  ssid = p.info
                  if ssid not in clients and ssid != "":
                      clients.append(ssid)
                      print len(clients),mac+"--Probing--&gt;"+ssid
                      if mac not in mach:
                          mach.append(mac)
                          global uni
                          uni+=1              
                      else:   
                          return
  
  sniff(iface=intf,prn=phandle, store=0)
  print ("\n")
  print "Unique MACs: ",uni
  </code></pre>
  
  <p>As you can see, I am filtering for probe requests and also filtering to see if the requests aren't broadcast but are for specific SSID's. I analyzed probe requests in <em>wireshark</em> to see that such probes also have a tag no <em>221</em> in <code>Dot11ELt</code> layer which specifies vendor. If I just change the <code>p.ID == 0</code> statement to <code>p.ID == 221</code> then it should technically give me the vendor info but instead the script just hangs and never moves forward with the rest of the script. </p>
  
  <p>How do I extract vendor info from the packet?</p>
  
  <p><strong>My python version:</strong> 2.7.3 (default, Mar 13 2014, 11:03:55) [GCC 4.7.2]
  <strong>My linux version:</strong> Distributor ID:Kali
                    Description:Kali GNU/Linux 1.1.0
                    Release:1.1.0
                    Codename:moto
                    <strong>Linux version</strong> 3.18.0-kali3-amd64
                    gcc version 4.7.2 
                    Debian 4.7.2-5) ) #1 SMP Debian 3.18.6-1~kali2 (2015-03-02)</p>