This example uses esp_wifi_80211_tx() to inject raw 802.11 frames on a chosen
channel and rate at a configurable frame rate (frames per second). It is meant as
a controllable interference / channel-occupancy source for stress-testing other
Wi-Fi links.
idf.py set-target esp32c5 # or your target
idf.py -p PORT flash monitorAfter boot you get an esp_tx> console prompt.
esp_tx -l <bytes> -r <rate> -p <phymode> -c <ch> -d <pps> -n <num>
| Option | Meaning | Default |
|---|---|---|
-l |
frame length in bytes (32..1500) | 1000 |
-r |
PHY rate name or hex (see below) | 6m |
-p |
PHY mode name (see below); omitted = inferred from rate | (auto) |
-c |
primary channel (1..14) | 1 |
-d |
target frames per second (pps), 0 = as fast as possible |
1000 |
-n |
number of frames, 0 = run until esp_tx_stop |
0 |
Stop a running (infinite) transmission:
esp_tx_stop
| Name | Meaning |
|---|---|
1m, 2m, 5.5m, 11m |
802.11b legacy |
6m, 9m, 18m, 24m, 36m, 48m, 54m |
802.11g/a OFDM |
mcs0 .. mcs9 |
HT MCS (long GI) |
mcs0_lgi, mcs0_sgi, … |
explicit GI suffix |
0x0B, 11 |
hex or decimal wifi_phy_rate_t index |
11b, 11g, 11a, ht20, ht40, he20, vht20
If -p is omitted, phymode is inferred from the rate (11b / 11g / HT20).
Saturate channel 6 with back-to-back 1500-byte frames (max rate):
esp_tx -l 1500 -r 6m -p 11g -c 6 -d 0 -n 0
Send 500 frames/sec of 1000-byte frames on channel 1:
esp_tx -l 1000 -r 54m -c 1 -d 500 -n 0
Send a fixed burst of 10000 frames at 200 frames/sec then stop automatically:
esp_tx -l 512 -r 11m -p 11b -c 11 -d 200 -n 10000
HE20 (802.11ax, chip must support HE):
esp_tx -l 1000 -r mcs0 -p he20 -c 6 -d 500 -n 0
- Frames are broadcast non-QoS data frames (Addr1 =
ff:ff:ff:ff:ff:ff), so no ACK is expected and the rate stays fixed (no rate-control fallback). - The raw-TX rate is applied with
esp_wifi_config_80211_tx(). On eachesp_txcommand the Wi-Fi protocol bitmap is set to match-p: legacy modes use11b/g/nonly;-p he20enables11axas well (if the chip supports HE). This avoidsconfig_80211_txfailures when mixing 11ax with legacy 11g rates. -dis paced per frame: the loop targets a period of1 s / pps, subtracting the time already spent on the frame (airtime + tx-done wait). If a single frame takes longer than the period, frames are sent as fast as possible and the achieved pps (printed in the summary) will be lower than requested.- Each frame waits for the 80211 tx-done callback, so the summary reports the number of frames actually transmitted on air and the achieved pps.
- This is a test tool; transmitting raw frames may be subject to local regulations. Use only in a controlled lab environment.