Skip to content
HackIndex logo

HackIndex

802.11 Frame Analysis with Wireshark and tshark

3 min read Mar 17, 2026

Wireshark and tshark decode 802.11 frames and let you inspect the full frame structure including management, control, and data frames. This is useful for confirming what airodump-ng is capturing, verifying handshakes, analysing authentication sequences, and decrypting traffic when the PSK is known.

Open a capture file directly, or capture live from a monitor mode interface.

Open a Capture in Wireshark

┌──(kali㉿kali)-[~]
└─$ wireshark capture-01.cap

For live capture directly from the monitor mode interface:

┌──(kali㉿kali)-[~]
└─$ wireshark -i wlan0mon

Essential Display Filters

Filter by frame type to reduce noise. 802.11 frames are split into management (type 0), control (type 1), and data (type 2):

┌──(kali㉿kali)-[~]
└─$ wlan.fc.type == 0
┌──(kali㉿kali)-[~]
└─$ wlan.fc.type == 2

Filter by specific management frame subtypes:

┌──(kali㉿kali)-[~]
└─$ wlan.fc.type_subtype == 8

Common subtype values: 8 = beacon, 4 = probe request, 5 = probe response, 0 = association request, 11 = authentication, 12 = deauthentication.

Filter by BSSID:

┌──(kali㉿kali)-[~]
└─$ wlan.bssid == AA:BB:CC:DD:EE:FF

Filter by SSID string:

┌──(kali㉿kali)-[~]
└─$ wlan.ssid contains "TargetNetwork"

Filter for EAPOL frames to confirm a WPA handshake is present in the capture:

┌──(kali㉿kali)-[~]
└─$ eapol

A valid WPA 4-way handshake consists of 4 EAPOL frames. You need at least frames 1 and 2, or frames 2 and 3, to have a crackable handshake. Wireshark labels these as Message 1 through Message 4 in the Info column when the 802.11 dissector is active.

Decrypt WPA Traffic with a Known PSK

If you have recovered the WPA passphrase, configure Wireshark to decrypt the traffic inline. Go to Edit > Preferences > Protocols > IEEE 802.11 > Decryption keys and add an entry in the format:

┌──(kali㉿kali)-[~]
└─$ wpa-pwd:passphrase:SSID

After adding the key, reload the capture. Wireshark decrypts data frames on the fly and the plaintext protocol content becomes visible in the packet details pane.

tshark at the Command Line

tshark is the CLI equivalent of Wireshark. Use it for scripted analysis and filtering without a GUI.

Show all beacon frames from a live capture:

┌──(kali㉿kali)-[~]
└─$ tshark -i wlan0mon -Y "wlan.fc.type_subtype == 8" -T fields -e wlan.ssid -e wlan.bssid -e wlan.ds.current_channel 
TargetNetwork	AA:BB:CC:DD:EE:FF	6
HomeNetwork	11:22:33:44:55:66	11

Read from a capture file instead of a live interface:

┌──(kali㉿kali)-[~]
└─$ tshark -r capture-01.cap -Y "eapol" -T fields -e frame.number -e wlan.sa -e wlan.da

Check whether a capture contains a complete handshake:

┌──(kali㉿kali)-[~]
└─$ tshark -r capture-01.cap -Y "eapol" | wc -l

4 or more EAPOL frames indicates a full handshake is likely present. Confirm with aircrack-ng before investing time in cracking:

┌──(kali㉿kali)-[~]
└─$ aircrack-ng capture-01.cap 
1 handshake found for network TargetNetwork (AA:BB:CC:DD:EE:FF)

Remote Capture into Wireshark

To capture on a remote Kali host and stream frames to a local Wireshark instance:

┌──(kali㉿kali)-[~]
└─$ ssh user@$TARGET_IP "tcpdump -w - -i wlan0mon" | wireshark -k -i -

This pipes the raw capture stream from the remote interface directly into Wireshark locally. Useful when the adapter is on a remote sensor or a Raspberry Pi closer to the target.

References