Now we will learn how to apply filters in Wireshark to look at Management, Control and Data Frames.
Please follow the below instructions step by step:
To view all the Management frames in the packets being captured, enter the filter
wlan.fc.type == 0
into the filter window and clickApply
. You can stop the packet capture if you want to prevent the packets from scrolling down too fast.To view Control Frames, modify the filter expression to read wlan.fc.type == 1.
To view data frames, modify the filter expression to wlan.fc.type == 2.
To additionally select a sub-type, use the
wlan.fc.subtype filter
. For example, to view all the Beacon frames among all Management frames, use the following filter:(wlan.fc.type == 0) && (wlan.fc.subtype == 8).
Alternately, you can right-click on any of the header fields in the middle window and then select Apply as Filter | Selected to add it as a filter.