Wireshark Most Common 802.11 Filters v1.1 Filter 802.11 Management Frames Filter 802.

11 Data Frames
Filter Addresses Description Description
802.11 Management Frames are used by stations to join and leave a BSS 802.11 Data Frames are mainly used to carry data (tupe = 2)
Addresses used for 802.11 communications There is a total of 12 802.11 Management Frames: There is a total of 15 802.11 Data Frames:
Up to 4 different MAC addresses can be used in an IEEE 802.11 frame: - Association request (subtype 0x0) - Beacon (subtype 0x8) - Data (subtype 0x0) - QoS Data (subtype 0x8)
- The transmitter MAC address or TA - Association response (subtype 0x1) - ATIM (subtype 0x9) - Data+CF-Ack (subtype 0x1) - QoS Data+CF-Ack (subtype 0x9)
- The receiver MAC address or RA - Reassociation request (subtype 0x2) - Disassociation (subtype 0xa) - Data+CF-Poll (subtype 0x2) - QoS Data+CF-Poll (subtype 0xa)
- The source MAC address or SA - Reassociation response (subtype 0x3) - Authentication (subtype 0xb) - Data+CF-Ack+CF-Poll (subtype 0x3) - QoS Data+CF-Ack+CF-Poll (0xb)
- The destination MAC address or DA - Probe request (subtype 0x4) - Deauthentication (subtype 0xc) - Null (subtype 0x4) - QoS Null (subtype 0xc)
- Probe response (subtype 0x5) - Action (subtype 0xd) - CF-Ack (subtype 0x5) - QoS CF-Poll (subtype 0xe)
Filters - CF-Poll (subtype 0x6) - QoS CF-Ack+CF-Poll (subt. 0xf)
Filters - CF-Ack+CF-Poll (subtype 0x7)
Filter for a specific client by MAC address: [Link] == MAC_address
Ex: [Link] == [Link] Filter for all management frames: [Link] == 0 Filters
Filter for Association Requests: [Link].type_subtype == 0
Filter by the transmitter address (TA): [Link] == MAC_address Filter for all data frames: [Link] == 2
Filter for Association Responses: [Link].type_subtype == 1
Ex: [Link] == [Link]
Filter for Reassociation Requests: [Link].type_subtype == 2 Filter for Data: [Link].type_subtype == 32
Filter by the receiver address (RA): [Link] == MAC_address Filter for Resssociation Responses: [Link].type_subtype == 3 Filter for Data+CF-Ack: [Link].type_subtype == 33
Ex: [Link] == [Link] Filter for Probe Requests: [Link].type_subtype == 4 Filter for Data+CF-Poll: [Link].type_subtype == 34
Filter for Probe Responses: [Link].type_subtype == 5 Filter for Data+CF-Ack+CF-Poll: [Link].type_subtype == 35
Filter by the source address (SA): [Link] == MAC_address
Filter for Beacons: [Link].type_subtype == 8 Filter for Null: [Link].type_subtype == 36
Ex: [Link] == [Link]
Filter for ATIMs: [Link].type_subtype == 9 Filter for CF-Ack: [Link].type_subtype == 37
Filter by the destination address (DA): [Link] == MAC_address Filter for Disassociations: [Link].type_subtype == 10 Filter for CF-Poll: [Link].type_subtype == 38
Ex: [Link] == [Link] Filter for CF-Ack+CF-Poll: [Link].type_subtype == 39
Filter for Authentications: [Link].type_subtype == 11
Filter for Deauthentications: [Link].type_subtype == 12 Filter for QoS Data: [Link].type_subtype == 40
Filter for Actions: [Link].type_subtype == 13 Filter for QoS Data+CF-Ack: [Link].type_subtype == 41
Filter Wi-Fi Networks Filter for QoS Data+CF-Poll: [Link].type_subtype == 42
Filter for QoS Data+CF-Ack+CF-Poll: [Link].type_subtype == 43
BSSID vs SSID Filter 802.11 Control Frames Filter for QoS Null: [Link].type_subtype == 44
BSSID is the MAC address of the radio transmitting in the AP Filter for QoS CF-Poll: [Link].type_subtype == 46
The BSSID is specific to 1 AP Description Filter for QoS CF-Ack+CF-Poll: [Link].type_subtype == 47
SSID is the name of the global Wi-Fi network 802.11 Control Frames assist with the delivery of data frames (type = 1)
The SSID can be used by multiple APs in a WLAN infrastructure There is a total of 8 802.11 Control Frames:

Filters
- Block ACK request (subtype 0x8)
- Block ACK (subtype 0x9)
- Clear To Send (subtype 0xc)
- ACK (subtype 0xd)
RadioTap Header Information
- PS-Poll (subtype 0xa) - CF-End (subtype 0xe)
Filter by BSSID (by AP): [Link] == AP_radio_MAC_address
- Ready To Send (subtype 0xb) - CF-End/CF-Ack (subtype 0xf)
Description
Ex: [Link] == [Link]
Filters RadioTap Headers provide additional information (channel frequency, data
Filter by SSID: wlan_mgt.ssid == your_SSID rate, signal strength...) to any 802.11 frame when capturing frames.
Ex: wlan_mgt.ssid == SemFio Filter for all control frames: [Link] == 1
Filter for Block ACK Requests: [Link].type_subtype == 24 Filters
Filter for Block ACKs: [Link].type_subtype == 25
Filter for PS-Polls: [Link].type_subtype == 26 Filter a specific channel: [Link] == frequency
Ex: [Link] == 5240
Filter for Ready To Sends: [Link].type_subtype == 27
Filter for Clear To Sends: [Link].type_subtype == 28 Filter a specific data rate: [Link] == rate_in_Mbps
Filter for ACKs: [Link].type_subtype == 29 Ex: [Link] <= 6
Filter for CF-Ends: [Link].type_subtype == 30 Filter by signal strength (RSSI): radiotap.dbm_antsignal == rate_in_dBm
Filter for CF-Ends/CF-Acks: [Link].type_subtype == 31 Ex: radiotap.dbm_antsignal >= -60

Sources: [Link] (11/25/15), [Link] (11/25/15), CWAP Official Study Guide (2011)