Time for action – viewing Management, Control, and Data frames
Now we will learn how to apply filters in Wireshark to look at management, control, and data frames.
Please follow these instructions step-by-step:
To view all the Management frames in the packets being captured, enter the filter wlan.fc.type == 0 into the filter window and click on Apply. You can stop the packet capture if you want to prevent the packets from scrolling down too fast:
To view Control Frames, modify the filter expression to read wlan.fc.type == 1:
To view the Data Frames, modify the filter expression to wlan.fc.type == 2:
To additionally select a sub-type, use the wlan.fc.subtype filter. For example, to view all the Beacon frames among all Management frames use the following filter (wlan.fc.type == 0) && (wlan.fc.subtype == 8).
Alternatively, you can right-click on any of the header fields in the middle window and then select Apply as Filter | Selected to add it as a filter:
This will automatically add the correct...
