# 802.11 Frame Analysis with Wireshark and tshark

> Capture and dissect 802.11 management, control, and data frames using Wireshark and tshark to identify wireless network structure and connected clients.

- **URL:** https://hackindex.io/platforms/wireless/reconnaissance/80211-frame-analysis-with-wireshark-and-tshark
- **Path:** Wireless > Reconnaissance
- **Up:** [Reconnaissance](https://hackindex.io/platforms/wireless/reconnaissance.md)
- **Published:** 2026-03-17
- **Updated:** 2026-09-12

Wireshark and tshark decode 802.11 frames and let you inspect the full frame structure including management, control, and data frames. This is useful for confirming what airodump-ng is capturing, verifying handshakes, analysing authentication sequences, and decrypting traffic when the PSK is known.

Open a capture file directly, or capture live from a monitor mode interface.

## Open a Capture for 802.11 Frame Analysis in Wireshark

```bash
wireshark capture-01.cap
```

For live capture directly from the monitor mode interface:

```bash
wireshark -i wlan0mon
```

## Essential Display Filters

Filter by frame type to reduce noise. 802.11 frames are split into three types:

- **Type 0**: management frames (beacons, probes, authentication, deauthentication)
- **Type 1**: control frames (ACK, RTS/CTS)
- **Type 2**: data frames (actual traffic)

Show only management frames:

```bash
wlan.fc.type == 0
```

```bash
wlan.fc.type == 2
```

Filter by specific management frame subtypes:

```bash
wlan.fc.type_subtype == 8
```

Common management frame subtype values:

- **`0`**: association request
- **`4`**: probe request
- **`5`**: probe response
- **`8`**: beacon
- **`11`**: authentication
- **`12`**: deauthentication

Filter by BSSID:

```bash
wlan.bssid == AA:BB:CC:DD:EE:FF
```

Filter by SSID string:

```bash
wlan.ssid contains "TargetNetwork"
```

Filter for EAPOL frames to confirm a WPA handshake is present in the capture:

```bash
eapol
```

A valid WPA 4-way handshake consists of 4 EAPOL frames. You need at least frames 1 and 2, or frames 2 and 3, to have a crackable handshake. Wireshark labels these as Message 1 through Message 4 in the Info column when the 802.11 dissector is active.

## Decrypt WPA Traffic with a Known PSK

If you have recovered the WPA passphrase, configure Wireshark to decrypt the traffic inline. Go to Edit > Preferences > Protocols > IEEE 802.11 > Decryption keys and add an entry in the format:

```bash
wpa-pwd:passphrase:SSID
```

After adding the key, reload the capture. Wireshark decrypts data frames on the fly and the plaintext protocol content becomes visible in the packet details pane.

## tshark at the Command Line

tshark is the CLI equivalent of Wireshark. Use it for scripted analysis and filtering without a GUI.

Show all beacon frames from a live capture:

```bash
tshark -i wlan0mon -Y "wlan.fc.type_subtype == 8" -T fields -e wlan.ssid -e wlan.bssid -e wlan.ds.current_channel
# TargetNetwork	AA:BB:CC:DD:EE:FF	6
# HomeNetwork	11:22:33:44:55:66	11
```

Read from a capture file instead of a live interface:

```bash
tshark -r capture-01.cap -Y "eapol" -T fields -e frame.number -e wlan.sa -e wlan.da
```

Check whether a capture contains a complete handshake:

```bash
tshark -r capture-01.cap -Y "eapol" | wc -l
```

4 or more EAPOL frames indicates a full handshake is likely present. Confirm with aircrack-ng before investing time in cracking:

```bash
aircrack-ng capture-01.cap
# 1 handshake found for network TargetNetwork (AA:BB:CC:DD:EE:FF)
```

## Remote Capture into Wireshark

To capture on a remote Kali host and stream frames to a local Wireshark instance:

```bash
ssh user@$TARGET_IP "tcpdump -w - -i wlan0mon" | wireshark -k -i -
```

This pipes the raw capture stream from the remote interface directly into Wireshark locally. Useful when the adapter is on a remote sensor or a Raspberry Pi closer to the target.

## References

- [Wireshark: WLAN display filter reference](https://www.wireshark.org/docs/dfref/w/wlan.html) - Full list of wlan.* display filter fields
- [Wireshark: tshark man page](https://www.wireshark.org/docs/man-pages/tshark.html) - Full flag and field extraction reference for tshark