Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Using Tshark, I would like to apply filter on a wireless sniffer capture such that (both a & b are satisfied) a) 802.11 beacons are present b) Packets belonging to a certain wireless MAC address are listed.

Can someone help me with the command for this?

Thanks!

share|improve this question

migrated from stackoverflow.com May 23 '13 at 10:44

This question came from our site for professional and enthusiast programmers.

2 Answers 2

Capture filter:

wlan host 00:11:22:33:44:55 and subtype beacon

You can find more capture and display filters here.

share|improve this answer

I would like to apply filter on a wireless sniffer capture such that (both a & b are satisfied) a) 802.11 beacons are present b) Packets belonging to a certain wireless MAC address are listed.

"both a & b are satisfied" could mean either "I want packets for which both a & b are true" or "I want packets for which a is true and packets for which b is true".

If you mean the former, i.e. "802.11 beacons belonging to a certain wireless MAC address should be the only packets", then, if you want packets sent to or from the MAC address, the other answer's filter is the correct capture filter. If you just want "sent to" or "sent from", use wlan dst host or wlan src host, respectively, rather than wlan host.

If you mean the latter, i.e. "802.11 beacons, and packets belonging to a certain wireless MAC address, should be the only packets", replace and with or.

For a display filter, replace wlan host 00:11:22:33:44:55 with wlan.addr == 11:22:33:44:55:66, replace wlan dst host 00:11:22:33:44:55 with wlan.da == 11:22:33:44:55:66, replace wlan src host 00:11:22:33:44:55 with wlan.sa == 11:22:33:44:55:66, and replace subtype beacon with wlan.fc.type_subtype == "Beacon frame".

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.