 | 1 | initial version |
I have had luck with this filter:
wlan.fixed.capabilities.privacy == 0
I haven't run WPA3 yet so don't know if it will be compatible or not. I suspect it will, but until tested, I can't be sure. This would pick up beacons with hidden SSIDs, so more information might come from Probe Responses that have this set like the SSID name. But, realistically, if the network is open with no security hiding the SSID is not going to help much (really at all).
Alternatively, you could look for management frames like beacons and probe responses that don't contain information elements related to WPA and RSN. But you would still have WEP to deal with to identify all open networks.