# RTL8720DN - Is 802.11 frame injection possible?

**URL:** https://forum.amebaiot.com/t/rtl8720dn-is-802-11-frame-injection-possible/883
**Category:** WiFi
**Tags:** rtl872xd
**Created:** [November 8, 2021, 12:26am UTC](https://forum.amebaiot.com/t/rtl8720dn-is-802-11-frame-injection-possible/883 "2021-11-08T00:26:55Z")
**Posts on this page:** 11
**Page:** 1

<div class="post-metadata">

### Author: ![xsutter](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.amebaiot.com/xsutter/32/565_2.png) [@xsutter](https://forum.amebaiot.com/u/xsutter)
#### Post date: [November 8, 2021, 12:26am UTC](https://forum.amebaiot.com/t/rtl8720dn-is-802-11-frame-injection-possible/883/1 "2021-11-08T00:26:56Z")

</div>

Hi all,

I need to achieve connectionless, low-latency point-to-point wireless transmission of a video signal. I cannot rely on a traditional wifi infrastructure with Access Point to do this. Therefore I want to directly inject 802.11 frames at the sender, and capture them at the receiver.

I am successfully using the RTL8720DN in wifi promiscuous mode with the Arduino SDK (3.0.8) to receive 802.11 frames. Now I need to be able to transmit those frames as well. Unfortunately in the wifi API I couldn’t find any explicit function to do this.

Hence my simple question: how can I inject 802.11 frames with the RTL8720DN ?

Thanks for help !

---

<div class="post-metadata">

### Author: ![xidameng](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.amebaiot.com/xidameng/32/18_2.png) [@xidameng](https://forum.amebaiot.com/u/xidameng)
#### Post date: [November 8, 2021, 2:08am UTC](https://forum.amebaiot.com/t/rtl8720dn-is-802-11-frame-injection-possible/883/2 "2021-11-08T02:08:08Z")

</div>

Hi frame injection is not supported under Arduino framework, as you can see, there is not API provided for such feature.

If you wanna dive deeper into the WiFi driver, you may wanna take a look of the Ameba D Standard SDK at [GitHub - ambiot/ambd\_sdk: SDK for AmebaD](https://github.com/ambiot/ambd_sdk)

---

<div class="post-metadata">

### Author: ![xsutter](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.amebaiot.com/xsutter/32/565_2.png) [@xsutter](https://forum.amebaiot.com/u/xsutter)
#### Post date: [November 8, 2021, 10:42am UTC](https://forum.amebaiot.com/t/rtl8720dn-is-802-11-frame-injection-possible/883/3 "2021-11-08T10:42:58Z")

</div>

Hi Simon,  
Thanks for your reply. I have looked throughout the AmebaD SDK, unfortunately I was not able to identify anything that would explicitly allow me to inject frames, nor could I find relevant examples. All examples provided use either Station or Access Point modes, which is not appropriate to what I am willing to do.

However there may be some non-obvious way to inject frames, maybe when the driver is in promiscuous mode. Can you please help me identify how I should proceed?

Thanks !  
Xavier

---

<div class="post-metadata">

### Author: ![xsutter](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.amebaiot.com/xsutter/32/565_2.png) [@xsutter](https://forum.amebaiot.com/u/xsutter)
#### Post date: [December 7, 2021, 7:24pm UTC](https://forum.amebaiot.com/t/rtl8720dn-is-802-11-frame-injection-possible/883/4 "2021-12-07T19:24:51Z")

</div>

Hi Simon,

I am still willing to inject frames in order to perform a short-range distribution of a low-latency, hi-speed audio-video stream. It will be a downstream-only transfer and there will be no upstream radio communication. So there will be no Access Point and no Station in my infrastructure, therefore I cannot rely on the usual Wifi connection mechanism. This is why I would like to build my own MAC frames and send them transparently.

I am now attempting to use the low-level API and make use of `rltk_wlan_send()`, which seems appropriate. Unfortunately I don’t know which of the following modes of operation I must use.

`wifi_on()` can be configured with any one of the following `rtw_mode_t` modes:

```auto
	RTW_MODE_NONE = 0,
	RTW_MODE_STA,
	RTW_MODE_AP,
	RTW_MODE_STA_AP,
	RTW_MODE_PROMISC,
	RTW_MODE_P2P

```

and `wext_set_mode()` accepts any one of the following modes:

```auto
#define IW_MODE_AUTO	0	/* Let the driver decides */
#define IW_MODE_ADHOC	1	/* Single cell network */
#define IW_MODE_INFRA	2	/* Multi cell network, roaming, ... */
#define IW_MODE_MASTER	3	/* Synchronisation master or Access Point */
#define IW_MODE_REPEAT	4	/* Wireless Repeater (forwarder) */
#define IW_MODE_SECOND	5	/* Secondary master/repeater (backup) */
#define IW_MODE_MONITOR	6	/* Passive monitor (listen only) */

```

Can you please tell me which mode / mode combination I have to use?  
And if `rltk_wlan_send()` is not the right way to go, can you tell me which other function will do the job?

Thanks for help !  
Regards

---

<div class="post-metadata">

### Author: ![xidameng](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.amebaiot.com/xidameng/32/18_2.png) [@xidameng](https://forum.amebaiot.com/u/xidameng)
#### Post date: [December 8, 2021, 9:49am UTC](https://forum.amebaiot.com/t/rtl8720dn-is-802-11-frame-injection-possible/883/5 "2021-12-08T09:49:01Z")

</div>

Hi @xsutter Xavier,

Despite my willingness to help you, I am not informed that such control

> [@xsutter](#):
>
> to build my own MAC frames and send them transparently

is possible even under the standard SDK.

Though, it’s highly possible that such functions exist in the pre-compiled archive library, and you can see their declarations in the header files, but unfortunately I don’t think I am able to point you to the right direction myself, I am more towards using the normal TCPIP stack thus was never bothered to look so deep.

---

<div class="post-metadata">

### Author: ![xsutter](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.amebaiot.com/xsutter/32/565_2.png) [@xsutter](https://forum.amebaiot.com/u/xsutter)
#### Post date: [December 8, 2021, 10:54am UTC](https://forum.amebaiot.com/t/rtl8720dn-is-802-11-frame-injection-possible/883/6 "2021-12-08T10:54:27Z")

</div>

Thank you Simon for your prompt response. I will try to dig deeper into the pre-compiled archive library. For some functions the comments are very sparse, and it is hardly possible to guess their exact behaviour and possible side-effects. Do you know where I can find a user manual of the underlying, pre-compiled firmware and libraries? This would be of great help !

Thank you very much for your support !  
Xavier

---

<div class="post-metadata">

### Author: ![xidameng](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.amebaiot.com/xidameng/32/18_2.png) [@xidameng](https://forum.amebaiot.com/u/xidameng)
#### Post date: [December 8, 2021, 12:49pm UTC](https://forum.amebaiot.com/t/rtl8720dn-is-802-11-frame-injection-possible/883/7 "2021-12-08T12:49:01Z")

</div>

> [@xsutter](#):
>
> I will try to dig deeper into the pre-compiled archive library.

👍👍👍👍👍👍👍👍

---

<div class="post-metadata">

### Author: ![sp9dev](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.amebaiot.com/sp9dev/32/1674_2.png) [@sp9dev](https://forum.amebaiot.com/u/sp9dev)
#### Post date: [September 26, 2023, 11:12pm UTC](https://forum.amebaiot.com/t/rtl8720dn-is-802-11-frame-injection-possible/883/8 "2023-09-26T23:12:35Z")

</div>

@xsutter Hi! Did you manage to find any way to accomplish this?

---

<div class="post-metadata">

### Author: ![xsutter](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.amebaiot.com/xsutter/32/565_2.png) [@xsutter](https://forum.amebaiot.com/u/xsutter)
#### Post date: [October 15, 2023, 8:57am UTC](https://forum.amebaiot.com/t/rtl8720dn-is-802-11-frame-injection-possible/883/9 "2023-10-15T08:57:48Z")

</div>

Hi,  
Unfortunately I didn’t, which forces me to now consider alternatives to the RTL8720DN. Too bad, as it is otherwise a very well-performing machine.

---

<div class="post-metadata">

### Author: ![pointertonull](https://avatars.discourse-cdn.com/v4/letter/p/f04885/32.png) [@pointertonull](https://forum.amebaiot.com/u/pointertonull)
#### Post date: [December 27, 2023, 11:51am UTC](https://forum.amebaiot.com/t/rtl8720dn-is-802-11-frame-injection-possible/883/10 "2023-12-27T11:51:30Z")

</div>

Im curious if there is something in the SDK that will allow this? I’ve posted a new thread in the forum, just came across this thread which looks to be what I am trying to achive for my project. Something like this [GitHub - Jeija/esp32-80211-tx: Send arbitrary IEEE 802.11 frames with Espressif's ESP32](https://github.com/Jeija/esp32-80211-tx) but for the RTL8720dn

---

<div class="post-metadata">

### Author: ![tesa-klebeband](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.amebaiot.com/tesa-klebeband/32/2098_2.png) [@tesa-klebeband](https://forum.amebaiot.com/u/tesa-klebeband)
#### Post date: [May 21, 2024, 1:55pm UTC](https://forum.amebaiot.com/t/rtl8720dn-is-802-11-frame-injection-possible/883/11 "2024-05-21T13:55:43Z")

</div>

Hello There!  
I have managed to accomplish raw IEEE 802.11 frame injection on an RTL8720dn. I have documented this experience on my blog [Making-raw-802-11-frame-injection-possible-on-an-rtl8720dn](https://tesa-klebeband.github.io/making-raw-802-11-frame-injection-possible-on-an-rtl8720dn). The link for the project on my GitHub is also included there.
