Re: Making own probe request sniffer, asking 802.11 and BPF in Pcap library.

[Guy Harris <guy () alum mit edu>]

On Jan 29, 2012, at 9:11 PM, Yohannes Affandy Siregar wrote:

> I'm curios about the BPF. Is there any BPF to filter probe request or
> management frame of 802.11 packet over a wireless network.

Yes.

> If yes, what is the filter expression?

As you asked about two types of filters, there's no "the" filter expression - there's a filter expression for probe 
requests, which are a particular type of management frames, and there's a different filter expression for management 
frames in general.

To quote the pcap-filter man page:

>        type wlan_type
>               True if  the  IEEE  802.11  frame  type  matches  the  specified
>               wlan_type.  Valid wlan_types are: mgt, ctl and data.
>
>        type wlan_type subtype wlan_subtype
>               True  if  the  IEEE  802.11  frame  type  matches  the specified
>               wlan_type and frame subtype matches the specified  wlan_subtype.
>
>               If the specified wlan_type is mgt, then valid wlan_subtypes are:
>               assoc-req,  assoc-resp,  reassoc-req,  reassoc-resp,  probe-req,
>               probe-resp, beacon, atim, disassoc, auth and deauth.
>
>               If the specified wlan_type is ctl, then valid wlan_subtypes are:
>               ps-poll, rts, cts, ack, cf-end and cf-end-ack.
>
>               If the specified wlan_type is  data,  then  valid  wlan_subtypes
>               are:  data,  data-cf-ack,  data-cf-poll, data-cf-ack-poll, null,
>               cf-ack, cf-poll, cf-ack-poll,  qos-data,  qos-data-cf-ack,  qos-
>               data-cf-poll, qos-data-cf-ack-poll, qos, qos-cf-poll and qos-cf-
>               ack-poll.
>
>        subtype wlan_subtype
>               True if the IEEE 802.11  frame  subtype  matches  the  specified
>               wlan_subtype  and  frame  has  the  type  to which the specified
>               wlan_subtype belongs.

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.