Wi Fi

Wi-Fi (WLAN, IEEE 802.11)

Wi-Fi, or IEEE 802.11, is the standard for wireless LANs, or WLANs. The abbreviation Wi-Fi stands for Wireless Fidelity, and resembles the Hi-Fi acronym. It represents a whole collection of protocols within the same family of Ethernet and Token Ring.

It is specified by various IEEE 802.11 specifications.

IEEE 802.11 sends network packets from the sending host to one (Unicast) or more (Multicast/Broadcast) receiving hosts.

The 802.11 protocols specify a wireless shared network, which means that the maximum bandwidth is only available to one user at a time.

See the CaptureSetup/WLAN page for instructions how to capture from WLAN's (including monitor mode), and see the CaptureSetup page for general information on capturing on WLAN's and other media.

802.11 Standards

The basic 802.11 standards are:

Some additional 802.11 standards are:


XXX - add a brief description of 802.11 history

802.11 vs. "fake Ethernet" captures

When capturing with Wireshark (or other tools using libpcap/WinPcap, such as TcpDump / WinDump) there are two ways in which 802.11 can be supplied by the system and stored in a capture file:

Detailed information about how to capture 802.11 traffic can be found at the CaptureSetup/WLAN page.

Protocol dependencies

Example traffic

One ICMP Ping Request and response session from Station(STA1 to station(STA2) via Access point(AP)
ICMP ECHO request

ICMP ECHO Response

XXX - Add example traffic here (as Wireshark screenshot).


The 802.11 dissector is fully functional. It supports WEP and WPA/WPA2 decryption (see HowToDecrypt802.11 for details) and 802.11n.

Capturing 802.11 traffic can be tricky, see CaptureSetup page for instructions how to capture from WLAN's (including monitor mode) and other media.

Preference Settings

802.11 is a complex protocol and Wireshark has a variety of 802.11-related preferences as a result.


The reassembly and retransmission settings can affect the way that higher-layer information is dissected and displayed. The FCS and Protection bit settings can affect how frames are decrypted. For detailed information about the decryption settings, see HowToDecrypt802.11.

You can also add 802.11-specific information to the packet list.


Example capture file


Display Filter

A complete list of 802.11 display filter fields can be found in the wlan, wlan_mgt, and wlan_aggregate display filter references.

Show only the 802.11-based traffic:


Show only the 802.11-based traffic to and from 802.11 MAC address 08:00:08:15:ca:fe:


Hide beacon frames:

 wlan.fc.type_subtype != 0x08

Show management frames for a specific SSID:

 wlan_mgt.ssid == "Spatula City"

Capture Filter

Newer versions of libpcap support raw 802.11 headers via the "wlan" link type. Older versions must use "ether" or "link" via fake Ethernet headers, and might not support 802.11 capture at all.

See CaptureSetup/WLAN page for instructions on how to capture from WLANs (including monitor mode).

External links


Imported from https://wiki.wireshark.org/Wi-Fi on 2020-08-11 23:27:26 UTC