tcpdump在wlan抓包时的可用过滤器

2020-12-03 19:31发布

抓包前使用iw命令创建一个监听模式(monitor)的接口

iw phy phy0 interface add mon0 type monitor

tcpdum抓包命令:

tcpdump -nei mon0 type WLAN_TYPE subtype SUB_WLAN_TYPE

WLAN_TYPE的可选值为:management(mgt) | control(ctl) | data

mgt对应的可选的SUB_WLAN_TYPE为:assoc-req, assoc-resp, reassoc-req, reassoc-resp, probe-req, probe-resp, beacon, atim, disassoc, auth, deauth

ctl对应的可选的SUB_WLAN_TYPE为: ps-poll, rts, cts, ack, cf-end, cf-end-ack

data对应的可选SUB_WLAN_TYPE为: data, data-cf-ack, data-cf-poll, data-cf-ack-poll, null, cf-ack, cf-poll, cf-ack-poll, qos-data, qos-data-cf-ack, qos-data-cf-poll, qos-data-cf-ack-poll, qos, qos-cf-poll, qos-cf-ack-poll

 

源自man pcap-filter

标签: