0

[Note: reposted here from SO...]

I've set Wireshark's capture filter set to capture only packets from the MAC address of interest, but the result is dominated by zillions of packets whose Protocol is "802.11". I want to view all of the packets that are NOT 802.11, e.g. ARP, DCHP, DNS, TCP, etc.

For example, in the following, I'd like to hide all of the 802.11 packets and show the DHCP packets (and any others that are NOT 802.11):

enter image description here

I tried "wlan.fc.type != 0", but clearly that's not correct. What's the magic keyword for such a filter?

Improve this question
0

1 Answer 1

Reset to default
2

To filter out 802.11, the filter is

!wlan

From https://www.wireshark.org/docs/dfref/w/wlan.html

Improve this answer
2
  • Thank you! I stared at that specific page for a while and it still wasn't clear that you could use a "naked" protocol name in a filter. But just one problem: that filters my DHCP packets as well.
    – fearless_fool
    Jan 12, 2021 at 16:12
  • You could try !wlan || dhcp
    – Ron Trunk
    Jan 12, 2021 at 16:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.