Wireshark Filters Commands

      Wireshark Tool Common 802.11 Filters Commands

Filters using MAC address 

Ex: wlan.addr == 11:22:33:44:55:66

Ex: wlan.ta == 11:22:33:44:55:66

Ex: wlan.ra == 11:22:33:44:55:66

Ex: wlan.sa == 11:22:33:44:55:66

Ex: wlan.da == 11:22:33:44:55:66

Ex: wlan.bssid == 11:22:33:44:55:66

Ex: wlan_mgt.ssid == “Test”

Filter 802.11 Management Frames

Filter for all management frames: 

wlan.fc.type == 0

Filter for Association Requests:  

wlan.fc.type_subtype == 0

Filter for Association Responses: 

wlan.fc.type_subtype == 1

Filter for Reassociation Requests: 

wlan.fc.type_subtype == 2

Filter for Resssociation Responses: 

wlan.fc.type_subtype == 3

Filter for Probe Requests: 

wlan.fc.type_subtype == 4

Filter for Probe Responses: 

wlan.fc.type_subtype == 5

Filter for Beacons:

wlan.fc.type_subtype == 8

Filter for ATIMs: 

wlan.fc.type_subtype == 9

Filter for Disassociations: 

wlan.fc.type_subtype == 10

Filter for Authentications: 

wlan.fc.type_subtype == 11

Filter for Deauthentications: 

wlan.fc.type_subtype == 12

Filter for Actions: 

wlan.fc.type_subtype == 13

Filter 802.11 Control Frames

Filter for all control frames: 

wlan.fc.type == 1

Filter for Block ACK Requests: 

wlan.fc.type_subtype == 24

Filter for Block ACKs: 

wlan.fc.type_subtype == 25

Filter for PS-Polls: 

wlan.fc.type_subtype == 26

Filter for Ready To Sends: 

wlan.fc.type_subtype == 27

Filter for Clear To Sends: 

wlan.fc.type_subtype == 28

Filter for ACKs: 

wlan.fc.type_subtype == 29

Filter for CF-Ends: 

wlan.fc.type_subtype == 30

Filter for CF-Ends/CF-Acks: 

wlan.fc.type_subtype == 31

Filter 802.11 Data Frames

Filter for all data frames: 

wlan.fc.type == 2

Filter for Data: 

wlan.fc.type_subtype == 32

Filter for Data+CF-Ack: 

wlan.fc.type_subtype == 33

Filter for Data+CF-Poll: 

wlan.fc.type_subtype == 34

Filter for Data+CF-Ack+CF-Poll: 

wlan.fc.type_subtype == 35

Filter for Null: 

wlan.fc.type_subtype == 36

Filter for CF-Ack: 

wlan.fc.type_subtype == 37

Filter for CF-Poll: 

wlan.fc.type_subtype == 38

Filter for CF-Ack+CF-Poll: 

wlan.fc.type_subtype == 39

Filter for QoS Data: 

wlan.fc.type_subtype == 40

Filter for QoS Data+CF-Ack: 

wlan.fc.type_subtype == 41

Filter for QoS Data+CF-Poll: 

wlan.fc.type_subtype == 42

Filter for QoS Data+CF-Ack+CF-Poll: 

wlan.fc.type_subtype == 43

Filter for QoS Null: 

wlan.fc.type_subtype == 44

Filter for QoS CF-Poll: 

wlan.fc.type_subtype == 46

Filter for QoS CF-Ack+CF-Poll: 

wlan.fc.type_subtype == 47

RadioTap Header Information

Ex: radiotap.channel.freq == 5240

Ex: radiotap.datarate <= 6

Ex: radiotap.dbm_antsignal >= -60

Filter for WLCCP packets along with address and data frame

Ex: (wlan.addr == 00:03:7f:c2:00:43 && wlan.fc.subtype==2 ) || wlccp