| Per-Packet Information (PPI) | Filter |
| Common Rate | ppi.80211-common.rate == 1000 ppi.80211-common.rate == 2000 ppi.80211-common.rate == 5500 ppi.80211-common.rate == 11000 ppi.80211-common.rate == 6000 ppi.80211-common.rate == 9000 ppi.80211-common.rate == 12000 ppi.80211-common.rate == 18000 ppi.80211-common.rate == 24000 |
| Complementary Code Keying (CCK) |
ppi.80211-common.chan.flags.cck == 1 |
| Orthogonal Frequency Division Multiplexing (OFDM) |
ppi.80211-common.chan.flags.ofdm == 1 |
| 2 GHz Spectrum | ppi.80211-common.chan.flags.2ghz == 1 |
| 5 GHz Spectrum | ppi.80211-common.chan.flags.5ghz == 1 |
| Dynamic CCK-OFDM | ppi.80211-common.chan.flags.dynamic == 1 |
| dBm Antenna Signal | ppi.80211-common.dbm.antsignal >= -70 |
| dBm Antenna Noise | ppi.80211-common.dbm.antnoise >= -95 |
| WLAN Management Frames | Filter |
| All management frames | wlan.fc.type == 0 |
| Association Requests | wlan.fc.type_subtype == 0 |
| Association Responses | wlan.fc.type_subtype == 1 |
| Reassociation Requests | wlan.fc.type_subtype == 2 |
| Resssociation Responses | wlan.fc.type_subtype == 3 |
| Probe Requests | wlan.fc.type_subtype == 4 |
| Probe Responses | wlan.fc.type_subtype == 5 |
| Beacons | wlan.fc.type_subtype == 8 |
| ATIMs | wlan.fc.type_subtype == 9 |
| Disassociations | wlan.fc.type_subtype == 10 |
| Authentications | wlan.fc.type_subtype == 11 |
| Deauthentications | wlan.fc.type_subtype == 12 |
| Actions | wlan.fc.type_subtype == 13 |
| WLAN Address | Filter |
| MAC Client All Directions | wlan.addr == {MAC_address} |
| Transmit Address | wlan.ta == {MAC_address} |
| Receive Address | wlan.ra == {MAC_address} |
| Source Address | wlan.sa == {MAC_address} |
| Destination Address | wlan.da == {MAC_address} |
| SSID | Filter |
| BSSID | wlan.bssid == AP_radio_MAC_address |
| SSID | wlan.ssid == “your_SSID” |
| SSID Hidden | wlan.ssid == “” |
| SSID Hidden Beacons | wlan.ssid == "" and wlan.fc.type_subtype == 8 |
| RF Patameters | Filter |
| Frequency | wlan_radio.frequency == {frequency} |
| Channel | wlan_radio.channel == {Channel} |
| Datarate | wlan_radio.data_rate == {rate in Mbps} |
| RSSI | wlan_radio.signal_dbm >= -80 |
| Noise | wlan_radio.noise_dbm >= -95 |
| SNR | wlan_radio.snr >= 25 |
| Channel Bandwidth | |
| PHY Type | wlan_radio.phy == 5 (802.11a) wlan_radio.phy == 6 (802.11b) wlan_radio.phy == 7 (802.11n) wlan_radio.phy == 8 (802.11ac) |