wireshark过滤802.11的各种帧

比如无线网卡上的各种beacon帧很多，很烦，可以直接

not wlan.fc.type_subtype == 0x08

打开wireshark，满脸的802.11 beacon帧

去除掉beacon帧后。

参考：
https://my.oschina.net/665544/blog/1647001

Management frame

wlan.fc.type == 0

Control frame

wlan.fc.type == 1

Data frame

wlan.fc.type == 2

Association request

wlan.fc.type_subtype == 0x00

Association response

wlan.fc.type_subtype == 0x01

Reassociation request

wlan.fc.type_subtype == 0x02

Reassociation response

wlan.fc.type_subtype == 0x03

Probe request

wlan.fc.type_subtype == 0x04

Probe response

wlan.fc.type_subtype == 0x05

Beacon

wlan.fc.type_subtype == 0x08

Disassociate

wlan.fc.type_subtype == 0x0A

Authentication

wlan.fc.type_subtype == 0x0B

Deauthentication

wlan.fc.type_subtype == 0x0C

Action frame

wlan.fc.type_subtype == 0x0D

Block ACK requests

wlan.fc.type_subtype == 0x18

Block ACK

wlan.fc.type_subtype == 0x19

Power save poll

wlan.fc.type_subtype == 0x1A

Request to send

wlan.fc.type_subtype == 0x1B

Clear to send

wlan.fc.type_subtype == 0x1C

ACK

wlan.fc.type_subtype == 0x1D

Contention free period end

wlan.fc.type_subtype == 0x1E

NULL data

wlan.fc.type_subtype == 0x24

QoS data

wlan.fc.type_subtype == 0x28

Null QoS data

wlan.fc.type_subtype == 0x2C

然后用sta1 ping sta2

mininet-wifi> sta1 ping sta2
PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data.
64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.180 ms
64 bytes from 10.0.0.2: icmp_seq=2 ttl=64 time=0.110 ms
^C
--- 10.0.0.2 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min/avg/max/mdev = 0.110/0.145/0.180/0.035 ms

然后在wireshark中只查看数据帧。过滤语法：

wlan.fc.type == 2

顺便修改一下wireshark的column，加上源/目端口，更容易知道数据包是哪个进程发起和接收的。