Wireshark-users: Re: [Wireshark-users] Capture filters for wlan
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 2 Jul 2010 01:03:22 -0700
On Jul 2, 2010, at 12:57 AM, Steve Evans wrote:

> This is the filter I always use:
> 
> wlan.da == mac || wlan.sa == mac || wlan.ra == mac || wlan.ta == mac
> 
> where mac is the host you want to monitor.

Those are display filters; the original poster wanted capture filters.

Unfortunately, there aren't libpcap capture filters for the TA and RA.  Time for me to dive into libpcap's grammar.y/gencode.c again, to add TA and RA filters....