Is there some capture filter (or alternatives) that is especially useful for wireless capture?

Question

I'm capturing wireless traffic in monitor mode with Wireshark. I want to capture traffic only for a certain BSS.

While wlan.bssid == xx:xx:xx:xx:xx:xx works well as a display filter, I don't want my data cluttered with useless traffic that I'm not interested in (the air is quite cluttered in every channel).

The questions here:

• Are there some especially useful capture filters for wireless capture?
• What's the best way to capture traffic to or from an AP only?

Answer 1

Here are some more useful capture filters:
wlan sa (source address):
wlan src XX:XX:XX:XX:XX:XX

wlan da (destination address):
wlan dst XX:XX:XX:XX:XX:XX

wlan ra (receiver address):
wlan addr1 XX:XX:XX:XX:XX:XX

wlan ta (transmitter address):
wlan addr2 XX:XX:XX:XX:XX:XX

wlan host XX:XX:XX:XX:XX:XX

Thanks to Guy Harris.

Answer 2

Capturing wireless traffic can be a proper bitch, as not all Wireless adapters will enter promiscuous mode as you might expect.

You might need an AirPcap device

As far as filters are concerned, I don't see why you can't use that as a display filter, export marked packets to a different pcap file, and then re-open that. I'm not sure that the same kind of filter for display works as a filter in capture mode. I'd just filter and export.

Answer 3

How about using the cmdline version of wireshark where you can specify all kinds of parameters.

root@kali-raspberry-pi1:~# tshark -tad -nni wlan0mon -f 'ether host d2:9e:43:xx:xx:xx and not broadcast'
Running as user "root" and group "root". This could be dangerous.
Capturing on 'wlan0mon'
** (tshark:8789) 16:41:26.778825 [Main MESSAGE] -- Capture started.
** (tshark:8789) 16:41:26.790889 [Main MESSAGE] -- File:
"/tmp/wireshark_wlan0monC2BKW1.pcapng" 1 2022-11-26 16:41:50.389080784 d2:9e:43:xx:xx:xx → da:f7:ec:xx:xx:xx 802.11 450 Probe Response, SN=424, FN=0, Flags=....R...C, BI=108, SSID="xxx"
2 2022-11-26 16:41:53.973077782 d2:9e:43:xx:xx:xx → 00:27:22:xx:xx:xx 802.11 450 Probe Response, SN=425, FN=0, Flags=....R...C, BI=108, SSID="xxx"
3 2022-11-26 16:41:53.978267971 d2:9e:43:xx:xx:xx → 00:27:22:28:ea:c2 802.11 450 Probe Response, SN=425, FN=0, Flags=....R...C, BI=108, SSID="xxx"
^Ctshark:
3 packets captured
root@kali-raspberry-pi1:~#

(xxx just in case you're one of my neighbors).