In diesem Beitrag werden einige Wireshark Filter vorgestellt. Wie man WLAN Traces erstellt und Wireshark startet wurde in einem vorherigen Beitrag beschrieben.

Framearten

Management Frames

Frame TypeWireshark Filter
Alle Management Frameswlan.fc.type==0

(Re-)Association Request / Response

Frame SubtypeWireshark Filter
Association Requestwlan.fc.type_subtype==0
Association Responsewlan.fc.type_subtype==1
Ressociation Requestwlan.fc.type_subtype==2
Ressociation Responsewlan.fc.type_subtype==3

Probe Request / Response

Frame SubtypeWireshark Filter
Probe Requestwlan.fc.type_subtype==4
Probe Responsewlan.fc.type_subtype==5

Beacon

Frame SubtypeWireshark Filter
Beaconwlan.fc.type_subtype==8

Announcement traffic
inidication message (ATIM)

Frame SubtypeWireshark Filter
ATIMwlan.fc.type_subtype==9

Disassociate

Frame SubtypeWireshark Filter
Disassociatewlan.fc.type_subtype==10

(De-)Authentication

Frame SubtypeWireshark Filter
Authenticationwlan.fc.type_subtype==11
Deauthenticationwlan.fc.type_subtype==12

Action

Frame SubtypeWireshark Filter
Actionwlan.fc.type_subtype==13

Control Frames

Frame TypeWireshark Filter
Alle Control Frameswlan.fc.type==1

Power Save Poll (PS-Poll)

Frame SubtypeWireshark Filter
Power-Save Pollwlan.fc.type_subtype==26

RTS / CTS

Frame SubtypeWireshark Filter
Request To Send (RTS)wlan.fc.type_subtype==27
Clear To Send (CTS)wlan.fc.type_subtype==28

(Block-)ACK

Frame SubtypeWireshark Filter
Block ACK Requestwlan.fc.type_subtype==24
Block ACK wlan.fc.type_subtype==25
Acknowledgement (ACK)wlan.fc.type_subtype==29

Contention-Free (CF)

Frame SubtypeWireshark Filter
CF-Endswlan.fc.type_subtype==30
CF-Ends / CF-ACKs wlan.fc.type_subtype==31

Data Frames

Frame TypeWireshark Filter
Alle Data Frameswlan.fc.type==2

Data

Frame SubtypeWireshark Filter
Datawlan.fc.type_subtype==32
Data + CF-ACKwlan.fc.type_subtype==33
Data + CF-Pollwlan.fc.type_subtype==34
Data + CF-ACK + CF-Pollwlan.fc.type_subtype==35
Nullwlan.fc.type_subtype==36
CF-ACKwlan.fc.type_subtype==37
CF-Pollwlan.fc.type_subtype==38
CF-ACK + CF-Pollwlan.fc.type_subtype==39

QoS Data

Frame SubtypeWireshark Filter
QoS Datawlan.fc.type_subtype==40
QoS Data + CF-ACKwlan.fc.type_subtype==41
QoS Data + CF-Pollwlan.fc.type_subtype==42
QoS Data + CF-ACK + CF-Pollwlan.fc.type_subtype==43
QoS Nullwlan.fc.type_subtype==44
QoS CF-Pollwlan.fc.type_subtype==46
QoS CF-ACK + CF-Pollwlan.fc.type_subtype==47

Adressen

Frame TypeWireshark Filter
Spezifische Adressewlan.addr==<macaddr>
AdresseWireshark Filter
Transmitter Address (TA)wlan.ta==<macaddr>
Receiver Address (RA)wlan.ra==<macaddr>
Source Address (SA)wlan.sa==<macaddr>
Destination Address (DA)wlan.da=<macaddr>

Netzwerk

AdresseWireshark Filter
BSSIDwlan.bssid==<macaddr>
SSIDwlan_mgt.ssid==“<SSID>“

RadioTap

AdresseWireshark Filter
Kanalradiotap.channel.freq==<Frequenz>
Data Rateradiotap.datarate==<datarate Mbps>
Signal Strength (RSSI)radiotap.dbm_antsignal==<strength dBm>