Null function packets with tshark capturing

edit

Hello everyone,

let me introduce you my scenario: I have two devices my smartphone Redmi Note 13 and a Rasperry Pi 4 with an ALFA AWUS036ACS AC600 USB Antenna. The Raspberry has already all the necessary drivers for using the antenna correctly. Now I have another smartphone for sharing the Wifi-Hotspot. The Redmi Note 13, which is the sender or transmitter of signals, uploads a data via WEBDAV or SFTP to my server a 5GB data on 2,4 GHz. The raspberry pi which is in monitor mode via sudo airmon-ng start wlan1 listens to the sender with the following command: tshark -i wlan1 -f "wlan tx xx:xx:xx:xx:xx:xx" -c 20 while xx:xx:xx:xx:xx:xx is the mac address of the sender.

As a result, I get mostly null functions (10-15 times in a row) and then a data packet.

In Wireshark when I filter with wlan.tx == MAC when observing wlan1, I get tonns of acks, clear to send, block acks and some null functions but not the same amount like there. The measured rssi's do give right strength with both commands.

1) What are Null function packets in general? I don't find it in IEEE documentation what the exact definition is. 2) Why do I get with capture filters (wlan tx) more null functions instead of in Wireshark with display filters (wlan.tx)? 3) What is the difference between wlan.sa and wlan.tx? In my experiment I get less packets with wlan.sa instead of wlan.tx. Wlan.tx is more reliable.

Thank you!