Wireshark Wireless Cheat sheet

802.11 frame types:
Management → wlan.fc.type == 0
Control → wlan.fc.type == 1
Data → wlan.fc.type == 2

Filter specific management subtypes:
Beacon → wlan.fc.type == 0 && wlan.fc.subtype == 8
Probe Request → wlan.fc.type == 0 && wlan.fc.subtype == 4
Probe Response → wlan.fc.type == 0 && wlan.fc.subtype == 5
Association Request → wlan.fc.type == 0 && wlan.fc.subtype == 0
Association Response → wlan.fc.type == 0 && wlan.fc.subtype == 1
Authentication → wlan.fc.type == 0 && wlan.fc.subtype == 11
Deauthentication → wlan.fc.type == 0 && wlan.fc.subtype == 12
Disassociation → wlan.fc.type == 0 && wlan.fc.subtype == 10

Roaming‑related frames
Reassociation Request — wlan.fc.type == 0 && wlan.fc.subtype == 2
Reassociation Response — wlan.fc.type == 0 && wlan.fc.subtype == 3
Authentication — wlan.fc.type == 0 && wlan.fc.subtype == 11
Deauthentication — wlan.fc.type == 0 && wlan.fc.subtype == 12
Disassociation — wlan.fc.type == 0 && wlan.fc.subtype == 10

Interference / Hidden Node Indicators
Retry frames — wlan.fc.retry == 1
Multiple retries — wlan.fc.more_frag == 1
RTS/CTS — wlan.fc.type == 1 && wlan.fc.subtype == 11
CTS — wlan.fc.type == 1 && wlan.fc.subtype == 12

Leave a Reply

Discover more from jo-roy

Subscribe now to keep reading and get access to the full archive.

Continue reading