This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Filtering 802.11 MAC Addresses

0

I am using an AirPcap with Wireshark for the first time and receiving lots of wireless packets. I am trying to filter by MAC address. So I tried using wlan_mgt.fixed.src_mac_addr == 00:06:66:54:21:75 for the MAC address that is transmitting but when I apply the filter it filters out everything including the packets sent by 00:06:66:54:21:75. So is there a way to filter 802.11 MAC addresses?

asked 02 Jul '13, 12:58

funonline41's gravatar image

funonline41
1●1●1●1
accept rate: 0%

One Answer:

0

wlan_mgt.fixed.src_mac_addr isn't the source address of an 802.11 packet, it's a field in the body of a management frame. Data and control frames don't even have that field.

If you want the source address of an 802.11 frame, it's wlan.sa, so what you want is wlan.sa == 00:06:66:54:21:75.

answered 02 Jul '13, 13:15

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k●3●35●196
accept rate: 19%

Thanks - That worked!

(02 Jul '13, 14:12) funonline41