Hi there, Is there a way to capture and display the mac addresses of devices with wifi enabled. I saw that the probe statement can be use full for this but i cannot find information to filter on that. Thanks for your Help. //p asked 23 May '14, 05:30  Pascal1969 edited 26 May '14, 02:01  grahamb ♦ |
One Answer:
sure, just use a capture device that is able to operate in wifi monitor mode to capture the wlan/wifi traffic in its vicinity. On Windows, you'll need
On Linux/Unix/*BSD you can use whatever wlan/wifi device is supported by your kernel. After you've finished capturing, you'll find an overview of the MAC addresses within several statistics functions (GUI: Statistics). You can also use tshark to print the MAC addresses.
Additionally to wlan.addr you can use any of the fields described here: http://www.wireshark.org/docs/dfref/w/wlan.html Regards answered 26 May '14, 16:58  Kurt Knochner ♦ |
Okay, a relative of me found this out....
wlan.fc.subtype == 0x04 as display filter.
It displays only de wlan devices that are probing.
Anybody nows how to change this in a capture filter?