Skip to content
HackIndex.io

802.11 Frame Analysis with Wireshark and tshark

3 min read Created Mar 17, 2026 Last updated Sep 12, 2026

Wireshark and tshark decode 802.11 frames and let you inspect the full frame structure including management, control, and data frames. This is useful for confirming what airodump-ng is capturing, verifying handshakes, analysing authentication sequences, and decrypting traffic when the PSK is known.

Open a capture file directly, or capture live from a monitor mode interface.

Open a Capture for 802.11 Frame Analysis in Wireshark

┌──(kali㉿kali)-[~]
└─$ wireshark capture-01.cap

For live capture directly from the monitor mode interface:

┌──(kali㉿kali)-[~]
└─$ wireshark -i wlan0mon

Essential Display Filters

Filter by frame type to reduce noise. 802.11 frames are split into three types:

  • Type 0: management frames (beacons, probes, authentication, deauthentication)

  • Type 1: control frames (ACK, RTS/CTS)

  • Type 2: data frames (actual traffic)

Show only management frames:

┌──(kali㉿kali)-[~]
└─$ wlan.fc.type == 0
┌──(kali㉿kali)-[~]
└─$ wlan.fc.type == 2

Filter by specific management frame subtypes:

┌──(kali㉿kali)-[~]
└─$ wlan.fc.type_subtype == 8

Common management frame subtype values:

  • 0: association request

  • 4: probe request

  • 5: probe response

  • 8: beacon

  • 11: authentication

  • 12: deauthentication

Filter by BSSID:

┌──(kali㉿kali)-[~]
└─$ wlan.bssid == AA:BB:CC:DD:EE:FF

Filter by SSID string:

┌──(kali㉿kali)-[~]
└─$ wlan.ssid contains "TargetNetwork"

Filter for EAPOL frames to confirm a WPA handshake is present in the capture:

┌──(kali㉿kali)-[~]
└─$ eapol

A valid WPA 4-way handshake consists of 4 EAPOL frames. You need at least frames 1 and 2, or frames 2 and 3, to have a crackable handshake. Wireshark labels these as Message 1 through Message 4 in the Info column when the 802.11 dissector is active.

Decrypt WPA Traffic with a Known PSK

If you have recovered the WPA passphrase, configure Wireshark to decrypt the traffic inline. Go to Edit > Preferences > Protocols > IEEE 802.11 > Decryption keys and add an entry in the format:

┌──(kali㉿kali)-[~]
└─$ wpa-pwd:passphrase:SSID

After adding the key, reload the capture. Wireshark decrypts data frames on the fly and the plaintext protocol content becomes visible in the packet details pane.

tshark at the Command Line

tshark is the CLI equivalent of Wireshark. Use it for scripted analysis and filtering without a GUI.

Show all beacon frames from a live capture:

┌──(kali㉿kali)-[~]
└─$ tshark -i wlan0mon -Y "wlan.fc.type_subtype == 8" -T fields -e wlan.ssid -e wlan.bssid -e wlan.ds.current_channel 
TargetNetwork	AA:BB:CC:DD:EE:FF	6
HomeNetwork	11:22:33:44:55:66	11

Read from a capture file instead of a live interface:

┌──(kali㉿kali)-[~]
└─$ tshark -r capture-01.cap -Y "eapol" -T fields -e frame.number -e wlan.sa -e wlan.da

Check whether a capture contains a complete handshake:

┌──(kali㉿kali)-[~]
└─$ tshark -r capture-01.cap -Y "eapol" | wc -l

4 or more EAPOL frames indicates a full handshake is likely present. Confirm with aircrack-ng before investing time in cracking:

┌──(kali㉿kali)-[~]
└─$ aircrack-ng capture-01.cap 
1 handshake found for network TargetNetwork (AA:BB:CC:DD:EE:FF)

Remote Capture into Wireshark

To capture on a remote Kali host and stream frames to a local Wireshark instance:

┌──(kali㉿kali)-[~]
└─$ ssh user@$TARGET_IP "tcpdump -w - -i wlan0mon" | wireshark -k -i -

This pipes the raw capture stream from the remote interface directly into Wireshark locally. Useful when the adapter is on a remote sensor or a Raspberry Pi closer to the target.

References