On May 13, 2010, at 9:11 AM, Anthony Murabito wrote:
> Hi Panos,
>
> wlan.fc.type_subtype != 0x04 && wlan.fc.type_subtype != 0x05
I.e., 802.11 probe packets don't contain the phrase "probe request" or "probe response"; those strings are contained, instead, in Wireshark and TShark (or, rather, in the library that both of them use to dissect packets), and they use them when displaying the packet summary and details. What the probe request and response packets contain (along with all other 802.11 packets) are a type and subtype field, with particular values for particular packet types, and what you need to check for are those packet types.
