0

[Note: reposted here from SO...]

I've set Wireshark's capture filter set to capture only packets from the MAC address of interest, but the result is dominated by zillions of packets whose Protocol is "802.11". I want to view all of the packets that are NOT 802.11, e.g. ARP, DCHP, DNS, TCP, etc.

For example, in the following, I'd like to hide all of the 802.11 packets and show the DHCP packets (and any others that are NOT 802.11):

enter image description here

I tried "wlan.fc.type != 0", but clearly that's not correct. What's the magic keyword for such a filter?

New contributor
fearless_fool is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
2

To filter out 802.11, the filter is

!wlan

From https://www.wireshark.org/docs/dfref/w/wlan.html

  • Thank you! I stared at that specific page for a while and it still wasn't clear that you could use a "naked" protocol name in a filter. But just one problem: that filters my DHCP packets as well. – fearless_fool Jan 12 at 16:12
  • You could try !wlan || dhcp – Ron Trunk Jan 12 at 16:17

Your Answer

fearless_fool is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.