Ethereal-users: [Ethereal-users] predefined 802.11 prism2 CAPTURE and DISPLAY filters?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: David C Wang <dave@xxxxxxxxxxxxxx>
Date: Wed, 22 Aug 2001 13:55:58 -0700
hi,

i was wondering if anyone has already made CAPTURE filters and DISPLAY
filters for the 802.11 patched version of ethereal and pcap.  i've
only begun using ethereal and would like to avoid writing a filter for
each frame type if someone else has already done it.  attached are
some that i have just made.

the capture filters skip 144 bytes until after the prism2 header to
the first link level 802.11 header, and then compare the type and
subtype bytes found in the frame control.  the display filters are
self explanatory.

if anyone has collected a lot of filters and could post them, i would
appreciate it very much.  thanks.

take care,
-dave
dcwang@xxxxxxx

CAPTURE FILTERS
------------------------------------------
no management beacons
link[144] != 0x80

no control acks
link[144] != 0xD4

no management beacons or control acks
(link[144] != 0x80 && link[144] != 0xD4)


DISPLAY FILTERS
------------------------------------------
no management beacons
!(wlan.fc.type==0 && wlan.fc.subtype==8)

no control acks
!(wlan.fc.type==1 && wlan.fc.subtype==13)