BPF filter source address == transmission address

Question

What is the correct BPF filter for only recieving packets where the source MAC address is equal to the transmission MAC address?

Looking at the documentation, it seems like the fields should be available through either wlan[21:12] or wlan.addr2 but I'm unable to get those to work.

Answer 1

According to the pcap-filter manpage, capture filters for tshark or Wireshark don't support comparing packet fields against each other.

You can, however, do that with the display filter (top bar in Wireshark, once capture started):

wlan.sa == wlan.ta

---

To check whether the DS flag is equal to 0x1 using a capture filter, you can do the following:

wlan[1] & 3 = 1

It retrieves the second byte of the wlan header (wlan[1]), masks the 2 lower bits (& 3), and compares the result to 1.