Wireshark 802.

11 Display Filter Field Reference

Frame Type/Subtype
Management frames
Filter
wlan.fc.type eq 0 IEEE 802.11
Control frames wlan.fc.type eq 1
Data frames wlan.fc.type eq 2 Pocket Reference Guide
Association request wlan.fc.type_subtype eq 0
Association response wlan.fc.type_subtype eq 1 SANS Institute
Reassociation request wlan.fc.type_subtype eq 2 www.sans.org
Reassociation response wlan.fc.type_subtype eq 3
Probe request wlan.fc.type_subtype eq 4
Probe response wlan.fc.type_subtype eq 5
Beacon wlan.fc.type_subtype eq 8 Acronyms
Announcement traffic indication map (ATIM) wlan.fc.type_subtype eq 9 AES Advanced Encryption Standard PEAP Protected EAP
Disassociate wlan.fc.type_subtype eq 10 AID Association Identifier PMK Pairwise Master Key
Authentication wlan.fc.type_subtype eq 11 AP Access Point PRGA Pseudo-Random Generation Algorithm
Deauthentication wlan.fc.type_subtype eq 12 BS Base Station PSK Pre-Shared Key
Action frames wlan.fc.type_subtype eq 13 BSS Basic Service Set PSPF Publicly Switched Packet Forwarding
Block ACK Request wlan.fc.type_subtype eq 24 BSSID Basic Service Set Identifier PTK Pairwise Temporal Key
Block ACK wlan.fc.type_subtype eq 25 CCA Clear Channel Assessment RF Radio Frequency
Power-Save Poll wlan.fc.type_subtype eq 26
CCMP Counter Mode with Cipher Block RFMON Radio Frequency Monitoring
Chaining Message Authentication RSSI Received Signal Strength Indicator
Request to Send wlan.fc.type_subtype eq 27
Code Protocol RTS Request to Send
Clear to Send wlan.fc.type_subtype eq 28
CTS Clear to Send SNR Signal to Noise Ratio
ACK wlan.fc.type_subtype eq 29
DS Distribution System SS Subscriber Station
Contention Free Period End wlan.fc.type_subtype eq 30 EAP Extensible Authentication Protocol SSID Service Set Identifier
Contention Free Period End ACK wlan.fc.type_subtype eq 31 FAST Flexible Authentication via Secure STA Station
Data + Contention Free ACK wlan.fc.type_subtype eq 33 Tunneling TIM Traffic Indication Map
Data + Contention Free Poll wlan.fc.type_subtype eq 34 ESS Extended Service Set TKIP Temporal Key Integrity Protocol
Data + Contention Free ACK + Contention Free Poll wlan.fc.type_subtype eq 35 FMS Fluhrer, Mantin, Shamir TLS Transport Layer Security
NULL Data wlan.fc.type_subtype eq 36 ICV Integrity Check Value TTLS Tunneled TLS
NULL Data + Contention Free ACK wlan.fc.type_subtype eq 37 ISM Industrial, Scientific, Medical WDS Wireless Distribution System
NULL Data + Contention Free Poll wlan.fc.type_subtype eq 38 IV Initialization Vector WEP Wired Equivalence Privacy
NULL Data + Contention Free ACK + Contention Free Poll wlan.fc.type_subtype eq 39 LEAP Lightweight EAP WIDS Wireless Intrusion Detection System
QoS Data wlan.fc.type_subtype eq 40 MAC Message Authenticity Check WPA WiFi Protected Access
QoS Data + Contention Free ACK wlan.fc.type_subtype eq 41 MAC Media Access Control WZC Wireless Zero Config
QoS Data + Contention Free Poll wlan.fc.type_subtype eq 42 MIC Message Integrity Check
QoS Data + Contention Free ACK + Contention Free Poll wlan.fc.type_subtype eq 43 NAV Network Allocation Vector
NULL QoS Data wlan.fc.type_subtype eq 44 OUI Organizationally Unique Identifier
NULL QoS Data + Contention Free Poll wlan.fc.type_subtype eq 46
NULL QoS Data + Contention Free ACK + Contention Free Poll wlan.fc.type_subtype eq 47

Sec617HANDOUT_80211
 IEEE 802.11 Header Reference
Management Frame Information Element Format
Bytes 1 1 0 - 32
Element ID Length SSID

Address Order Common Management Tag Values

From DS Set, To DS Clear: From DS Clear, To DS Set: 0 SSID 1 Supported data rates
Address 1: Destination Address 1: BSSID 2 Frequency Hopping Channel Set 3 Direct Sequence Channel Set
Address 2: BSSID Address 2: Source 4 Contention Free period 5 Traffic Indication Map
Address 3: Source Address 3: Destination 6 IBSS (Ad-hoc) parameter set 7 Country Information
From DS Clear, To DS Clear: From DS Set, To DS Set: 0x30 RSN Information Element 0x85 Cisco CCX Extensions 1
Address 1: Destination Address 1: Receiver 0x88 Cisco CCX Extensions 2 0x95 Cisco CCX Extensions 3
Address 2: Source Address 2: Transmitter 0x2D High Throughput (.11n) capability 0x34 AP Neighbor Report
Address 3: BSSID Address 3: Destination 0x3d High Throughput (.11n) information 0x2E QoS Capability
Address 4: Source 0x22 Transmit Power Control Request 0x23 Transmit Power Control Response
0x24 Supported Channels 0x32 Extended supported data rates
Frame Control Sub-Fields
Kismet Quick Reference
Panels Reference Popup Windows
e List Kismet servers h Help
z Toggle full-screen view n Name current network
m Toggle muting of sound i View detailed information for network
t Tag or untag selected network s Sort network list
Frame Control Sub-Field Data g Group tagged networks l Show wireless card power levels
u Ungroup current group d Dump printable strings
Protocol: 0, only supported protocol identifier More Frag: Set, more fragments remaining
c Show clients in current network r Packet rate graph
Type: Retry: Set, packet is being retransmitted
L Lock channel hopping to selected a View network statistics
0 Management Frame Power Management: Set, STA is entering
channel
1 Control Frame power conservation state
H Return to normal channel hopping p Dump packet type
2 Data Frame More Data: Set, AP has more buffered
+/- Expand/collapse groups f Follow network center
Subtype: Function of the frame based on frame type frames for STA
CTRL+L Re-draw the screen w Track alerts
From DS set, To DS Clear: From Wired to Wireless WEP/Privacy Bit: Set, data frame is
Q Quit Kismet x Close popup window
From DS clear, To DS Set: From Wireless to Wired encrypted using WEP, TKIP or CCMP
From DS clear, To DS Clear: Ad-hoc is type is data Strict: Set, station requires frames to be
From DS Set, To DS Set: WDS network delivered in order Network Type Flags
P Probe Request A Access Point
H Ad-Hoc Network T Turbocell
Sequence Control Sub-Fields G Group D Data only network

Status Flags
F Vulnerable factor configuration T# TCP traffic # frames identified
U# UDP traffic # frames identified A# ARP traffic # frames identified
D Address identified through DHCP W WEP network decrypted