This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I'm currently capturing traffic in tshark and applying a display filter like to capture only probe request: tshark -n -l -i wlan0 -R 'wlan.fc.type_subtype == 0x0004 && wlan_mgt.ssid != "" && wlan.fcs_good == 1' -T fields -e wlan.sa -e wlan_mgt.ssid

My trace are so huge as there's no capture filter, in tcpdump style, but I can't find anything for 802.11 How can I create a capture filter that would limit my traffic to Probe request only? Or at least management frames or ...

Thanks!

asked 03 Nov '15, 10:08

TomLaBaude's gravatar image

TomLaBaude
66171724
accept rate: 66%


How can I create a capture filter that would limit my traffic to Probe request only?

By reading the pcap-filter man page, which documents the syntax of libpcap/WinPcap capture filters as used by tcpdump/WinDump, Wireshark, etc., in particular the part describing the "type" and "subtype" keywords, and then noticing that one of the possible "subtype" values is "probe-req", so that "subtype probe-req" would be the filter.

Or at least management frames

If you want management frames in general, that'd be "type mgt", as per that man page.

permanent link

answered 03 Nov '15, 14:22

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

-1

Add wlan.fc.type == 0 to your filter to only get management frames. Null data frames also have subtype of 4.

permanent link

answered 04 Feb '16, 12:41

Ted%20Wards's gravatar image

Ted Wards
5114
accept rate: 0%

Hi Ted, thanks for answering, but this is a display filter, not a capture filter. Guy gave me the answer.

(05 Feb '16, 01:26) TomLaBaude
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×184
×134
×114

question asked: 03 Nov '15, 10:08

question was seen: 10,483 times

last updated: 05 Feb '16, 01:26

p​o​w​e​r​e​d by O​S​Q​A