0

Using Tshark, I would like to apply filter on a wireless sniffer capture such that (both a & b are satisfied) a) 802.11 beacons are present b) Packets belonging to a certain wireless MAC address are listed.

Can someone help me with the command for this?

Thanks!

migrated from stackoverflow.com May 23 '13 at 10:44

This question came from our site for professional and enthusiast programmers.

1

Capture filter:

wlan host 00:11:22:33:44:55 and subtype beacon

You can find more capture and display filters here.

0

I would like to apply filter on a wireless sniffer capture such that (both a & b are satisfied) a) 802.11 beacons are present b) Packets belonging to a certain wireless MAC address are listed.

"both a & b are satisfied" could mean either "I want packets for which both a & b are true" or "I want packets for which a is true and packets for which b is true".

If you mean the former, i.e. "802.11 beacons belonging to a certain wireless MAC address should be the only packets", then, if you want packets sent to or from the MAC address, the other answer's filter is the correct capture filter. If you just want "sent to" or "sent from", use wlan dst host or wlan src host, respectively, rather than wlan host.

If you mean the latter, i.e. "802.11 beacons, and packets belonging to a certain wireless MAC address, should be the only packets", replace and with or.

For a display filter, replace wlan host 00:11:22:33:44:55 with wlan.addr == 11:22:33:44:55:66, replace wlan dst host 00:11:22:33:44:55 with wlan.da == 11:22:33:44:55:66, replace wlan src host 00:11:22:33:44:55 with wlan.sa == 11:22:33:44:55:66, and replace subtype beacon with wlan.fc.type_subtype == "Beacon frame".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy