Wireshark Tool Common 802.11 Filters Commands
Filters using MAC address
Ex: wlan.addr == 11:22:33:44:55:66
Ex: wlan.ta == 11:22:33:44:55:66
Ex: wlan.ra == 11:22:33:44:55:66
Ex: wlan.sa == 11:22:33:44:55:66
Ex: wlan.da == 11:22:33:44:55:66
Ex: wlan.bssid == 11:22:33:44:55:66
Ex: wlan_mgt.ssid == “Test”
Filter 802.11 Management Frames
Filter for all management frames:
wlan.fc.type == 0
Filter for Association Requests:
wlan.fc.type_subtype == 0
Filter for Association Responses:
wlan.fc.type_subtype == 1
Filter for Reassociation Requests:
wlan.fc.type_subtype == 2
Filter for Resssociation Responses:
wlan.fc.type_subtype == 3
Filter for Probe Requests:
wlan.fc.type_subtype == 4
Filter for Probe Responses:
wlan.fc.type_subtype == 5
Filter for Beacons:
wlan.fc.type_subtype == 8
Filter for ATIMs:
wlan.fc.type_subtype == 9
Filter for Disassociations:
wlan.fc.type_subtype == 10
Filter for Authentications:
wlan.fc.type_subtype == 11
Filter for Deauthentications:
wlan.fc.type_subtype == 12
Filter for Actions:
wlan.fc.type_subtype == 13
Filter 802.11 Control Frames
Filter for all control frames:
wlan.fc.type == 1
Filter for Block ACK Requests:
wlan.fc.type_subtype == 24
Filter for Block ACKs:
wlan.fc.type_subtype == 25
Filter for PS-Polls:
wlan.fc.type_subtype == 26
Filter for Ready To Sends:
wlan.fc.type_subtype == 27
Filter for Clear To Sends:
wlan.fc.type_subtype == 28
Filter for ACKs:
wlan.fc.type_subtype == 29
Filter for CF-Ends:
wlan.fc.type_subtype == 30
Filter for CF-Ends/CF-Acks:
wlan.fc.type_subtype == 31
Filter 802.11 Data Frames
Filter for all data frames:
wlan.fc.type == 2
Filter for Data:
wlan.fc.type_subtype == 32
Filter for Data+CF-Ack:
wlan.fc.type_subtype == 33
Filter for Data+CF-Poll:
wlan.fc.type_subtype == 34
Filter for Data+CF-Ack+CF-Poll:
wlan.fc.type_subtype == 35
Filter for Null:
wlan.fc.type_subtype == 36
Filter for CF-Ack:
wlan.fc.type_subtype == 37
Filter for CF-Poll:
wlan.fc.type_subtype == 38
Filter for CF-Ack+CF-Poll:
wlan.fc.type_subtype == 39
Filter for QoS Data:
wlan.fc.type_subtype == 40
Filter for QoS Data+CF-Ack:
wlan.fc.type_subtype == 41
Filter for QoS Data+CF-Poll:
wlan.fc.type_subtype == 42
Filter for QoS Data+CF-Ack+CF-Poll:
wlan.fc.type_subtype == 43
Filter for QoS Null:
wlan.fc.type_subtype == 44
Filter for QoS CF-Poll:
wlan.fc.type_subtype == 46
Filter for QoS CF-Ack+CF-Poll:
wlan.fc.type_subtype == 47
RadioTap Header Information
Ex: radiotap.channel.freq == 5240
Ex: radiotap.datarate <= 6
Ex: radiotap.dbm_antsignal >= -60
Filter for WLCCP packets along with address and data frame
Ex: (wlan.addr == 00:03:7f:c2:00:43 && wlan.fc.subtype==2 ) || wlccp