Use Wireshark to filter on any defined byte sequence within your packet. This will display all advertising packets with the defined MAC address. To get the mac address, type ncpa. Filter example: btle.advertisingaddress f2:f1:d1:a1:9c:1f. To filter out a mac address in Wireshark, make a filter like so: not eth.addrF4-6D-04-E5-0B-0D. If you can't figure that address out with a short capture on the AP interface, you can find it by tapping the blue-circled "i" next to the SSID (network name) of your hosted Wi-Fi in Settings: Wi-Fi. Locate and build the following filter and enter desired MAC address to filter on. You can also filter on the IP address of the iPhone. You can find an iPhone's Wi-Fi MAC address in: I've looked at the PCAP-FILTER Manpage and it is unclear. Once you switch which interface you're capturing on, you can filter by the MAC address of your iPhone: tcpdump supports the ether qualifier to specify ethernet addresses in the standard colon-separated format. There are (up to) 4 fields in an 802.11 frame that contain mac addresses: source mac transmitter mac destination mac receiver mac Is there a pcap capture filter for these values Something similar to ether host ff:ff:ff:ff:ff:ff, for example. If you've been capturing on the hosting computer's Internet-facing interface, you're probably seeing the iPhone's traffic after it gets NATed to the same IP and MAC addresses as your computer. If that adapter shows up in the list of interfaces Wireshark can capture on, choosing the SoftAP adapter instead of the adapter your computer uses for it's Internet connection should narrow down what packets you see and let you see the iPhone's Wi-Fi IP and MAC addresses, which will both be different from your computer's addresses.
Wireless Hosted Networking creates virtual wireless adapters, including a SoftAP adapter.
0 kommentar(er)
