Method in wireshark to filter for any in a set of mac addresses but no others

Question

I am sniffing for several devices in a congested environment. I'm wondering if there is an easy way to accomplish filtering that I don't know of.

I have two APs that things are connecting to so I filter by wlan.addr==xx || wlan.addr==xx etc., but this leaves in a bunch of probes from other systems around me which I do not need in the sniff. It would be nice to filter things out and make smaller files.

I want to say something like (wlan.addr==xx || wlan.addr==xx) && no other addresses.

Right now I could do that by (wlan.addr==AP1 && wlan.addr=device1) || (wlan.addr==AP2 && wlan.addr=device1) etc. for all possible combinations, but it would be long and possibly prone to errors. Hoping there is a shorter solution.

Thanks for any help or ideas

Answer 1

You could use the filters wlan.da==aa:aa:aa:aa:aa:aa and wlan.sa==bb:bb:bb:bb:bb:bb where da stands for Destination Address, and sa stands for "Source Address".

So, something like:

(wlan.sa==xx || wlan.sa==yy) && wlan.da==zz

Answer 2

Even if this defies normal programmatic logic, Wireshark (or rather the underlying capture filter) is smart enough to understand

(wlan.addr==11:11:11:11:11:11 || wlan.addr==22:22:22:22:22:22) && wlan.addr==33:33:33:33:33:33

because wlan.addr matches either source or destination address. That way you can simply match both directions.