wireshark capture filter for a specific network (bssid)

Question

I would like to know how to capture packets of a specific wireless network using wireshark.

I'm already able to capture all packets of different networks setting my wireless card in monitor mode but for a specific analysis i need to discard all the packets not related to my network during the capture procedure.

I know that exists display filters to do that but i need to filter them ahead (like with capture filters).

If i go to CAPTURE->OPTIONS i can set capture filters but i don't know the exact filter because they are different from display filter infact wlan.bssid==xx:xx:xx:xx:xx:xx does not work.

any suggestions?

thanks

Answer 1

You could use an index from the start of the wlan packet. It needs some coaxing, but the BSSID field is in a fixed, predictable position. By using brackets, you should be able to reference the proper positions in the packet.

The BSSID is at position 16, so if you wanted to emulate something like:

wlan.bssid=12:34:56:78:9a:bc

you would have to do something like this:

wlan[16:4] == 0x12345678 and wlan[20:2] == 0x9abc 

You have to convert the first 4 octets into a int32 and the last 2 into an int16 and use 2 clauses, as BPF cannot express a 6 byte number, but I've used it and it works fine. This can also be adapted to other uses as well (you just need the offset).

Answer 2

Excellent question and something I've been trying to figure out also.

The short answer is the wireshark tools cannot filter on BSSID. Wireshark uses pcap, which uses the kernel Linux Socker Filter (based on BPF) via the SO_ATTACH_FILTER ioctl. There is no BPF filter for BSSID.

Another tool, airodump-ng, CAN capture by BSSID because it passes all 802.11 frames into user space and decodes/filters frames there. It works surprisingly well considering all the user-space processing.

But even a low-volume 80211 network is fairly noisy. For example, my SOHO captures 11K frames in under two minutes; and I still drop frames. Grabbing all the 80211 frames for the five visible (but small!) BSSIDs near me and I receive 141K frames (104MB) in just under three minutes.

I'm looking to do an embedded frame sniffer/injector using EMMC or SD flash so I need to be careful about pushing the limits.

So I'm trying to write a custom BDF filter to filter only the local BSSID frames. And I hope to extend it to drop a good amount of the "noisy" frames - most of the control and management frames can be filtered. The BSSID address location in the frame is based on ToDS and FromDS control bits.

Anyway, hope I provided some breadcrumbs to the solution. It may just be an airodump user-space solution is the easiest.