Ask Your Question
0

Frame type display filter returning empty

asked 2018-03-30 10:58:51 +0000

anonymous user

Anonymous

updated 2018-03-30 13:33:43 +0000

cmaynard gravatar image

When I apply a display filter for wlan frame types (wlan.fc.type eq 0) no results will show up. Sorry if I'm doing something very simple wrong but I couldn't find any solutions to my problem.

Using Wireshark 2.2.13.

https://prnt.sc/iygdyi image description

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2018-03-30 13:41:35 +0000

cmaynard gravatar image

Most likely you have not captured the real 802.11 frames but are dealing with "fake" Ethernet frames. You can verify this by looking at the Encapsulation type listed in Wireshark's "Statistics -> Capture File Properties" page. If it says, "Ethernet", you don't have 802.11 frames, thus your filter isn't going to work.

You can read more about the real 802.11 frames vs the fake Ethernet frames on the Wi-Fi (WLAN, IEEE 802.11) wiki page, and be sure to have a look at the WLAN (IEEE 802.11) capture setup page as well.

edit flag offensive delete link more

Comments

And that screenshot looks Windows-ish; you won't get real 802.11 frames on most platforms, including Windows, unless you're capturing in monitor mode, and, on Windows, you can only capture in monitor mode if you have Npcap, rather than WinPcap, installed. Wireshark's installer installs WinPcap; you would have to install Npcap yourself.

Guy Harris gravatar imageGuy Harris ( 2018-03-31 02:32:09 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2018-03-30 10:58:51 +0000

Seen: 55 times

Last updated: Mar 30