pcap (wireshark) filter by wlan mac address

Question

There are (up to) 4 fields in an 802.11 frame that contain mac addresses:

• source mac
• transmitter mac
• destination mac
• receiver mac

Is there a pcap capture filter for these values? Something similar to ether host ff:ff:ff:ff:ff:ff, for example.

I've looked at the PCAP-FILTER Manpage and it is unclear.

Answer 1

I think I found a solution, thanks to this answer: Server Fault - Is there some capture filter (or alternatives) that is especially useful for wireless capture?.

Source Address: wlan src XX:XX:XX:XX:XX:XX or wlan sa XX:XX:XX:XX:XX:XX
Destination Address: wlan dst XX:XX:XX:XX:XX:XX or wlan da XX:XX:XX:XX:XX:XX
Receiver Address: wlan addr1 XX:XX:XX:XX:XX:XX or wlan ra XX:XX:XX:XX:XX:XX
Transmitter Address: wlan addr2 XX:XX:XX:XX:XX:XX or wlan ta XX:XX:XX:XX:XX:XX

Support for ra and ta was added to pcap in 2010 per release notes:

Fri. August 6, 2010. [email protected]. Summary for 1.1.2 libpcap release

• Return DLT_ values, not raw LINKTYPE_ values from pcap_datalink() when reading pcap-ng files
• Add support for "wlan ra" and "wlan ta", to check the RA and TA of WLAN frames that have them
• Don't crash if "wlan addr{1,2,3,4}" are used without 802.11 headers