Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm capturing wireless traffic in monitor mode with WireShark. I want to capture traffic only for a certain BSS. While wlan.bssid == xx:xx:xx:xx:xx:xx works well as a display filter, I don't want my data cluttered with useless traffic that I'm not interested in (the air is quite cluttered in every channel).

So the question here:

  • Are there some especially useful capture filters for Wireless capture?
  • What's the best way to capture traffic to or from an AP only?
share|improve this question

2 Answers 2

up vote 1 down vote accepted

Here are some more useful capture filters:
wlan sa (source address):
wlan src XX:XX:XX:XX:XX:XX

wlan da (destination address):
wlan dst XX:XX:XX:XX:XX:XX

wlan ra (receiver address):
wlan addr1 XX:XX:XX:XX:XX:XX

wlan ta (transmitter address):
wlan addr2 XX:XX:XX:XX:XX:XX

wlan host XX:XX:XX:XX:XX:XX

Thanks to Guy Harris.

share|improve this answer

Capturing wireless traffic can be a proper bitch, as not all Wireless adapters will enter promiscuous mode as you might expect.

You might need an AirPcap device

As far as filters are concerned, I don't see why you can't use that as a display filter, export marked packets to a different pcap file, and then re-open that. I'm not sure that the same kind of filter for display works as a filter in capture mode. I'd just filter and export.

share|improve this answer
    
The wireless capturing part is already working. Maybe I'll have to filter and export. Display filter does not work as capture filter. –  Haozhun Feb 14 '12 at 10:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.