Per-Packet Information (PPI) | Filter |
Common Rate | ppi.80211-common.rate == 1000 ppi.80211-common.rate == 2000 ppi.80211-common.rate == 5500 ppi.80211-common.rate == 11000 ppi.80211-common.rate == 6000 ppi.80211-common.rate == 9000 ppi.80211-common.rate == 12000 ppi.80211-common.rate == 18000 ppi.80211-common.rate == 24000 |
Complementary Code Keying (CCK) |
ppi.80211-common.chan.flags.cck == 1 |
Orthogonal Frequency Division Multiplexing (OFDM) |
ppi.80211-common.chan.flags.ofdm == 1 |
2 GHz Spectrum | ppi.80211-common.chan.flags.2ghz == 1 |
5 GHz Spectrum | ppi.80211-common.chan.flags.5ghz == 1 |
Dynamic CCK-OFDM | ppi.80211-common.chan.flags.dynamic == 1 |
dBm Antenna Signal | ppi.80211-common.dbm.antsignal >= -70 |
dBm Antenna Noise | ppi.80211-common.dbm.antnoise >= -95 |
WLAN Management Frames | Filter |
All management frames | wlan.fc.type == 0 |
Association Requests | wlan.fc.type_subtype == 0 |
Association Responses | wlan.fc.type_subtype == 1 |
Reassociation Requests | wlan.fc.type_subtype == 2 |
Resssociation Responses | wlan.fc.type_subtype == 3 |
Probe Requests | wlan.fc.type_subtype == 4 |
Probe Responses | wlan.fc.type_subtype == 5 |
Beacons | wlan.fc.type_subtype == 8 |
ATIMs | wlan.fc.type_subtype == 9 |
Disassociations | wlan.fc.type_subtype == 10 |
Authentications | wlan.fc.type_subtype == 11 |
Deauthentications | wlan.fc.type_subtype == 12 |
Actions | wlan.fc.type_subtype == 13 |
WLAN Address | Filter |
MAC Client All Directions | wlan.addr == {MAC_address} |
Transmit Address | wlan.ta == {MAC_address} |
Receive Address | wlan.ra == {MAC_address} |
Source Address | wlan.sa == {MAC_address} |
Destination Address | wlan.da == {MAC_address} |
SSID | Filter |
BSSID | wlan.bssid == AP_radio_MAC_address |
SSID | wlan.ssid == “your_SSID” |
SSID Hidden | wlan.ssid == “” |
SSID Hidden Beacons | wlan.ssid == "" and wlan.fc.type_subtype == 8 |
RF Patameters | Filter |
Frequency | wlan_radio.frequency == {frequency} |
Channel | wlan_radio.channel == {Channel} |
Datarate | wlan_radio.data_rate == {rate in Mbps} |
RSSI | wlan_radio.signal_dbm >= -80 |
Noise | wlan_radio.noise_dbm >= -95 |
SNR | wlan_radio.snr >= 25 |
Channel Bandwidth | |
PHY Type | wlan_radio.phy == 5 (802.11a) wlan_radio.phy == 6 (802.11b) wlan_radio.phy == 7 (802.11n) wlan_radio.phy == 8 (802.11ac) |