Wireshark · Ethereal-users: Re: [Ethereal-users] 802.11b - just the beacons please

[Guy Harris <gharris@xxxxxxxxx>]

On Tue, Jun 26, 2001 at 11:03:01PM -0700, Guy Harris wrote:
> That's a display filter.  Those do not work as capture filters; they
> only work as display filters to show particular packets in a set of
> packets you've captured.

...although Tethereal lets you specify a *read* filter on the command
line, even for live captures, using the "-R" flag.  (Ethereal doesn't
currently support read filters for live captures; it may do so in the
future.)  So for Tethereal you could filter with the expression you
mentioned (or, in the current CVS version of Tethereal, with

	wlan.fc.type_subtype == 8

which checks a synthetic field that consists of the value from the type
*and* subtype fields, i.e. the actual packet type; for that matter, in
the current CVS version, you can do

	wlan.fc.type_subtype == "Beacon frame"

in case you don't happen to know the correct numerical value without
looking it up...).

However, capture filters are a much more CPU-efficient way of filtering
out packets; it may be that the traffic is low enough, or that the CPU
is insufficiently busy, for this to make a difference, in which case you
can use a read filter with Tethereal, but if you end up losing packets,
a capture filter might do better.