2

I'm capturing wireless traffic in monitor mode with Wireshark. I want to capture traffic only for a certain BSS.

While wlan.bssid == xx:xx:xx:xx:xx:xx works well as a display filter, I don't want my data cluttered with useless traffic that I'm not interested in (the air is quite cluttered in every channel).

The questions here:

  • Are there some especially useful capture filters for wireless capture?
  • What's the best way to capture traffic to or from an AP only?

3 Answers 3

1

Here are some more useful capture filters:
wlan sa (source address):
wlan src XX:XX:XX:XX:XX:XX

wlan da (destination address):
wlan dst XX:XX:XX:XX:XX:XX

wlan ra (receiver address):
wlan addr1 XX:XX:XX:XX:XX:XX

wlan ta (transmitter address):
wlan addr2 XX:XX:XX:XX:XX:XX

wlan host XX:XX:XX:XX:XX:XX

Thanks to Guy Harris.

1
  • The filter wlan.sa == 8a:07:9d:74:ad:31 worked for me in the Wireshark GUI. Nov 23, 2022 at 19:36
3

Capturing wireless traffic can be a proper bitch, as not all Wireless adapters will enter promiscuous mode as you might expect.

You might need an AirPcap device

As far as filters are concerned, I don't see why you can't use that as a display filter, export marked packets to a different pcap file, and then re-open that. I'm not sure that the same kind of filter for display works as a filter in capture mode. I'd just filter and export.

1
  • The wireless capturing part is already working. Maybe I'll have to filter and export. Display filter does not work as capture filter.
    – Haozhun
    Feb 14, 2012 at 10:14
0

How about using the cmdline version of wireshark where you can specify all kinds of parameters.

root@kali-raspberry-pi1:~# tshark -tad -nni wlan0mon -f 'ether host d2:9e:43:xx:xx:xx and not broadcast'
Running as user "root" and group "root". This could be dangerous.
Capturing on 'wlan0mon'
** (tshark:8789) 16:41:26.778825 [Main MESSAGE] -- Capture started.
** (tshark:8789) 16:41:26.790889 [Main MESSAGE] -- File:
"/tmp/wireshark_wlan0monC2BKW1.pcapng" 1 2022-11-26 16:41:50.389080784 d2:9e:43:xx:xx:xx → da:f7:ec:xx:xx:xx 802.11 450 Probe Response, SN=424, FN=0, Flags=....R...C, BI=108, SSID="xxx"
2 2022-11-26 16:41:53.973077782 d2:9e:43:xx:xx:xx → 00:27:22:xx:xx:xx 802.11 450 Probe Response, SN=425, FN=0, Flags=....R...C, BI=108, SSID="xxx"
3 2022-11-26 16:41:53.978267971 d2:9e:43:xx:xx:xx → 00:27:22:28:ea:c2 802.11 450 Probe Response, SN=425, FN=0, Flags=....R...C, BI=108, SSID="xxx"
^Ctshark:
3 packets captured
root@kali-raspberry-pi1:~#

(xxx just in case you're one of my neighbors).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.