wireshark capture filter for a specific network (bssid)

Question

I would like to know how to capture packets of a specific wireless network using wireshark.

I'm already able to capture all packets of different networks setting my wireless card in monitor mode but for a specific analysis i need to discard all the packets not related to my network during the capture procedure.

I know that exists display filters to do that but i need to filter them ahead (like with capture filters).

If i go to CAPTURE->OPTIONS i can set capture filters but i don't know the exact filter because they are different from display filter infact wlan.bssid==xx:xx:xx:xx:xx:xx does not work.

any suggestions?

thanks

Answer 1

You could use an index from the start of the wlan packet. It needs some coaxing, but the BSSID field is in a fixed, predictable position. By using brackets, you should be able to reference the proper positions in the packet.

The BSSID is at position 16, so if you wanted to emulate something like:

wlan.bssid=12:34:56:78:9a:bc

you would have to do something like this:

wlan[16:4] == 0x12345678 and wlan[20:2] == 0x9abc 

You have to convert the first 4 octets into a int32 and the last 2 into an int16 and use 2 clauses, as BPF cannot express a 6 byte number, but I've used it and it works fine. This can also be adapted to other uses as well (you just need the offset).