Wireshark · Wireshark-users: Re: [Wireshark-users] Capture filters for wlan

[Guy Harris <guy@xxxxxxxxxxxx>]

On Jul 2, 2010, at 12:57 AM, Steve Evans wrote:

> This is the filter I always use:
> 
> wlan.da == mac || wlan.sa == mac || wlan.ra == mac || wlan.ta == mac
> 
> where mac is the host you want to monitor.

Those are display filters; the original poster wanted capture filters.

Unfortunately, there aren't libpcap capture filters for the TA and RA.  Time for me to dive into libpcap's grammar.y/gencode.c again, to add TA and RA filters....