I am sniffing for several devices in a congested environment. I'm wondering if there is an easy way to accomplish filtering that I don't know of.

I have two APs that things are connecting to so I filter by wlan.addr==xx || wlan.addr==xx etc., but this leaves in a bunch of probes from other systems around me which I do not need in the sniff. It would be nice to filter things out and make smaller files.

I want to say something like (wlan.addr==xx || wlan.addr==xx) && no other addresses.

Right now I could do that by (wlan.addr==AP1 && wlan.addr=device1) || (wlan.addr==AP2 && wlan.addr=device1) etc. for all possible combinations, but it would be long and possibly prone to errors. Hoping there is a shorter solution.

Thanks for any help or ideas

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Dec 25 '18 at 8:09

You could use the filters wlan.da==aa:aa:aa:aa:aa:aa and wlan.sa==bb:bb:bb:bb:bb:bb where da stands for Destination Address, and sa stands for "Source Address".

So, something like:

(wlan.sa==xx || wlan.sa==yy) && wlan.da==zz

Even if this defies normal programmatic logic, Wireshark (or rather the underlying capture filter) is smart enough to understand

(wlan.addr==11:11:11:11:11:11 || wlan.addr==22:22:22:22:22:22) && wlan.addr==33:33:33:33:33:33

because wlan.addr matches either source or destination address. That way you can simply match both directions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy