Fuzzing a client (-m ap)

Hi,

I'm unsure about the use of this tool. I'm running the fuzzer with openwifi running on top of a zed board + AD-FMCOMMS4-EBZ FMC.

When using the mode AP to fuzz a client, following the example given in the README instructions:

`sudo ./src/owfuzz -i sdr0 -m ap -c [channel] -t [sta-mac] -b [ap-mac] -s [ap-mac] -T 2 -A WPA2_PSK_TKIP_AES -I [sta-ip]`

Should I create the AP separately (using hostapd with a different wireless interface) and then input that information (mac address, channel, bssid, auth, etc.) to owfuzz? The paper you published seemed to indicate that is done by owfuzz itself, but I haven't managed to archieve this (quote: "If the target device is a client, the fuzzing controller simulates Owfuzz as an AP to process client frames and replies corresponding response frames. When simulating an AP, the fuzzing controller will broadcast beacon frames every 100 ms to announce its existence.").

On the other hand, when fuzzing an AP (-m sta), like so:
`owfuzz -i sdr0 -m sta - c 1 -t -b -s -T 2 -A WPA2_PSS_AES -S -I `

I simultaneously sniffed the frames with an alfa card in monitor mode and realised the mac source was equal to the target (destination) mac, even though I specified the option -s. Any thoughts on why that may be happening?