Wireshark filtering for one network

Question

How do i make Wireshark filter results so it just shows results from one wifi net work. I have had a look on Google but found nothing. Can any one help.

Solution 1

Sorry for not posting comment, I dont have enough "points" :). It is possibile to get data from different networks, I have been using that for debugging rts/cts packets.

You can use filter to get desired results. Here are I beleive useful filters to you, got them from google search.

Show only the 802.11-based traffic:

wlan

Show only the 802.11-based traffic to and from 802.11 MAC address 08:00:08:15:ca:fe:

wlan.addr==08.00.08.15.ca.fe

Hide beacon frames:

wlan.fc.type_subtype != 0x08

Show management frames for a specific SSID:

wlan_mgt.ssid == "Spatula City"

Solution 2

Most, but not all, 802.11 packets contain a header field to report which "BSSID" the packet is on. The BSSID is the MAC address of the AP (Access Point; think "Wi-Fi router") that is hosting that network.

The Wireshark syntax for this is:

wlan.bssid == 00.11.22.33.44.55

Note that a simultaneous dual-band AP is technically two APs in one; one for each band. So it would have two BSSes, each with its own BSSID. And larger Wi-Fi networks are made up of lots of APs, each with its own BSSID. But then again, unless you're running multiple capture radios on your Wireshark machine simultaneously, you can't be tuned to multiple bands or channels at the same time.

As I mentioned before, not all 802.11 packets report their BSSID. Specifically, tiny control frames such as CTSes and ACKs contain little more than the MAC address of the intended receiver and a few status bits. The only way to tell which BSSID those frames are associated with is to see if they were transmitted during a tiny timing window right before (in the case of a CTS) or right after (in the case of an ACK) a data frame with the right BSSID. Most sniffers aren't smart enough to associate CTSes and ACKs with their corresponding data frames based on timing, so it's very difficult to keep these CTSes and ACKs in your capture if you're filtering stuff out based on BSSID.

Comments

[Nathan C]

Wireshark picks up packets from the network you're connected to only...unless you're using something else.

[09stephenb]

@NathanC Is there any thing that picks them up from networks i'm not connected to.

[Spiff]

@NathanC That is incorrect. Wireshark can do 802.11 monitor-mode packet capture where it picks up all packets on the channel you're tuned to, regardless of which network they're on.