This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Display mac addresses from wifi clients

0

Hi there,

Is there a way to capture and display the mac addresses of devices with wifi enabled. I saw that the probe statement can be use full for this but i cannot find information to filter on that.

Thanks for your Help.

//p

asked 23 May '14, 05:30

Pascal1969's gravatar image

Pascal1969
11112
accept rate: 0%

edited 26 May '14, 02:01

grahamb's gravatar image

grahamb ♦
19.8k330206

Okay, a relative of me found this out....

wlan.fc.subtype == 0x04 as display filter.

It displays only de wlan devices that are probing.

Anybody nows how to change this in a capture filter?

(23 May '14, 08:48) Pascal1969

One Answer:

0

Is there a way to capture and display the mac addresses of devices with wifi enabled

sure, just use a capture device that is able to operate in wifi monitor mode to capture the wlan/wifi traffic in its vicinity.

http://wiki.wireshark.org/CaptureSetup/WLAN

On Windows, you'll need

  • either a sniffer that does not rely on WinPcap (as WinPcap does not support monitor mode)
  • or a special capture device like AirPcap.

On Linux/Unix/*BSD you can use whatever wlan/wifi device is supported by your kernel.

After you've finished capturing, you'll find an overview of the MAC addresses within several statistics functions (GUI: Statistics).

You can also use tshark to print the MAC addresses.

tshark -nr input.pcap -T fields -e wlan.addr

Additionally to wlan.addr you can use any of the fields described here: http://www.wireshark.org/docs/dfref/w/wlan.html

Regards
Kurt

answered 26 May '14, 16:58

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%