Examples include management WLAN traffic, such as Probe Requests which are randomized during network discovery, and Authentication and Association frames which are randomized during WLAN association. For example:īecause most WLAN frames are either encrypted or do not carry an Ethernet header, analysis of the local and group Ethernet bits is not viable. This is because the bitwise AND operator is not granular enough to mask bits within the 4-bit nibble. This results in the second character matching 2, 6, a, or e as follows.īitwise AND will be true when attempting the following display filter. These MAC addresses follow RFC 7042 (section 2.1) rules where the second least significant bit of the 48-bit MAC address' most significant byte is set signifying that it is locally administered. Many device manufacturers now randomize the MAC address during WLAN discovery, and again during WLAN association. Please consider providing a mask that applies to bits within a nibble or compiling a change to the 802.11 protocol dissector that would apply to wlan.addr, wlan.ta, wlan.ra, wlan.da, and wlan.sa filters. Provide a more granular way to filter MAC addresses.

Wireshark mac address filter example