tcpdump在wlan抓包时的可用过滤器

抓包前使用iw命令创建一个监听模式（monitor)的接口

iw phy phy0 interface add mon0 type monitor

tcpdum抓包命令：

tcpdump -nei mon0 type WLAN_TYPE subtype SUB_WLAN_TYPE

WLAN_TYPE的可选值为：management(mgt) | control(ctl) | data

mgt对应的可选的SUB_WLAN_TYPE为：assoc-req, assoc-resp, reassoc-req, reassoc-resp, probe-req, probe-resp, beacon, atim, disassoc, auth， deauth

ctl对应的可选的SUB_WLAN_TYPE为： ps-poll, rts, cts, ack, cf-end, cf-end-ack

data对应的可选SUB_WLAN_TYPE为： data, data-cf-ack, data-cf-poll, data-cf-ack-poll, null, cf-ack, cf-poll, cf-ack-poll, qos-data, qos-data-cf-ack, qos-data-cf-poll, qos-data-cf-ack-poll, qos, qos-cf-poll, qos-cf-ack-poll

源自man pcap-filter

tcpdump在wlan抓包时的可用过滤器

原文：https://www.cnblogs.com/Reggie/p/12095790.html