Wireshark Wi-Fi filters

There are three types of Wi-F- frames; management, control and data. Within each of those types there are various subtypes.

The capture filters are the same on Wireshark as they are on tcpdump, so they can be used with either program.

Frame typeCapture filterDisplay filter
Management (all)wlan type mgtwlan.fc.type==0
Association requestwlan subtype assoc-reqwlan.fc.type_subtype==
Association responsewlan subtype assoc-respwlan.fc.type_subtype==
Reassociation requestwlan subtype reassoc-reqwlan.fc.type_subtype==0x0002
Reassociation responsewlan subtype reassoc-respwlan.fc.type_subtype==0x0003
Probe requestwlan subtype probe-reqwlan.fc.type_subtype==0x0004
Probe responsewlan subtype probe-respwlan.fc.type_subtype==0x0005
Beaconwlan subtype beaconwlan.fc.type_subtype==0x0008
ATIMwlan subtype atimwlan.fc.type_subtype==
Disassociationwlan subtype disassocwlan.fc.type_subtype==
Authennticationwlan subtype authwlan.fc.type_subtype==0x000b
Deauthenticationwlan subtype deauthwlan.fc.type_subtype==0x000c
Actionwlan.fc.type_subtype==0x000d
Action no ackwlan.fc.type_subtype==
Aruba Managementwlan.fc.type_subtype==0x000f
Control (all)wlan type ctlwlan.fc.type==1
Control wrapper
Block ack request
Block ack
PS-Pollwlan subtype ps-poll
RTSwlan subtype rts
CTSwlan subtype cts
ACKwlan subtype ack
CF-Endwlan subtype cf-end
CF-End and CF-ackwlan subtype cf-end-ack
Data (all)wlan type datawlan.fc.type==2