Wireshark · Wireshark-dev: [Wireshark-dev] Filter Request To send Clear To send and Prism Header

["david lopez" <dalopezperez@xxxxxxxxx>]

Hello

 

I'm working with Tethereal

I need to capture WLAN packets as quick as it is possible

 

I'm interested only in Request to Send and Clear to Send sequences and more specificly in their Prism Header

My questions are:

- What filter can I use for capturig only this king of packets?

- Once I'm only capturing RTS/CTS sequences, what filter can I use for capturing only the MacTime in the Prism Header?#

 

Now I'm using this:

-R '(wlan.fc.type_subtype eq 27)||(wlan.fc.type_subtype eq 28) (RTS/CTS sequences)

-z proto,colinfo,prism.mactime.data,prism.mactime.data (MacTime in Prism Header)

 

However, I think these filter are not for capturing, they are only for display that information in the output file.

 

All the best

 

David