aLt's Security Blog

Wireless Frame Format Using Tcpdump tcpdump -i <interface> -s 0 -nne 'wlan type <type> subtype <subtype>' Note older versions of tcpdump and wireshark capture filter dosn't support the "wlan" keyword, just use "type <type> subtype <subtype>" Sniffing wireless in monitor mode, ignore beacon's tcpdump -i <interface> -s 0 -nne '(type mgt or type ctl or type data) and (not type mgt subtype beacon)' type subtype mgt assoc-req assoc-resp reassoc-req reassoc-resp probe-req probe-resp beacon atim disassoc auth deauth ctl ps-poll rts cts ack cf-end cf-end-ack data data data-cf-ack data-cf-poll data-cf-ack-poll null cf-ack cf-poll cf-ack-poll qos-data qos-data-cf-ack qos-data-cf-poll qos-data-cf-ack-poll qos qos-cf-poll qos-cf-ack-poll Wlan Capture  Using Wireshark wlan.fc.type == 0 Management frames wlan.fc.type == 1 Control fram