This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi there,

Is there a way to capture and display the mac addresses of devices with wifi enabled. I saw that the probe statement can be use full for this but i cannot find information to filter on that.

Thanks for your Help.

//p

asked 23 May '14, 05:30

Pascal1969's gravatar image

Pascal1969
11112
accept rate: 0%

edited 26 May '14, 02:01

grahamb's gravatar image

grahamb ♦
19.8k330206

Okay, a relative of me found this out....

wlan.fc.subtype == 0x04 as display filter.

It displays only de wlan devices that are probing.

Anybody nows how to change this in a capture filter?

(23 May '14, 08:48) Pascal1969

Is there a way to capture and display the mac addresses of devices with wifi enabled

sure, just use a capture device that is able to operate in wifi monitor mode to capture the wlan/wifi traffic in its vicinity.

http://wiki.wireshark.org/CaptureSetup/WLAN

On Windows, you'll need

  • either a sniffer that does not rely on WinPcap (as WinPcap does not support monitor mode)
  • or a special capture device like AirPcap.

On Linux/Unix/*BSD you can use whatever wlan/wifi device is supported by your kernel.

After you've finished capturing, you'll find an overview of the MAC addresses within several statistics functions (GUI: Statistics).

You can also use tshark to print the MAC addresses.

tshark -nr input.pcap -T fields -e wlan.addr

Additionally to wlan.addr you can use any of the fields described here: http://www.wireshark.org/docs/dfref/w/wlan.html

Regards
Kurt

permanent link

answered 26 May '14, 16:58

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×349
×40
×5

question asked: 23 May '14, 05:30

question was seen: 7,975 times

last updated: 26 May '14, 16:58

p​o​w​e​r​e​d by O​S​Q​A