The main purpose of the document is to give an understanding of the 802.11 packet structure and how to analyze wireless packet captures.

Open Authentication for Troubleshooting.

Monitor Mode for Wireless Packet Captures.

Wireless Hosted Networking creates virtual wireless adapters, including a SoftAP adapter.

If that adapter shows up in the list of interfaces Wireshark can capture on, choosing the SoftAP adapter instead of the adapter your computer uses for it's Internet connection should narrow down what packets you see and let you see the iPhone's Wi-Fi IP and MAC addresses, which will both be different from your computer's addresses. If you've been capturing on the hosting computer's Internet-facing interface, you're probably seeing the iPhone's traffic after it gets NATed to the same IP and MAC addresses as your computer.

There are (up to) 4 fields in an 802.11 frame that contain mac addresses: source mac transmitter mac destination mac receiver mac Is there a pcap capture filter for these values Something similar to ether host ff:ff:ff:ff:ff:ff, for example. Once you switch which interface you're capturing on, you can filter by the MAC address of your iPhone: tcpdump supports the ether qualifier to specify ethernet addresses in the standard colon-separated format. You can find an iPhone's Wi-Fi MAC address in: I've looked at the PCAP-FILTER Manpage and it is unclear. You can also filter on the IP address of the iPhone. Locate and build the following filter and enter desired MAC address to filter on. If you can't figure that address out with a short capture on the AP interface, you can find it by tapping the blue-circled 'i' next to the SSID (network name) of your hosted Wi-Fi in Settings: Wi-Fi. To filter out a mac address in Wireshark, make a filter like so: not eth.addrF4-6D-04-E5-0B-0D. Filter example: btle.advertisingaddress f2:f1:d1:a1:9c:1f. This will display all advertising packets with the defined MAC address. Use Wireshark to filter on any defined byte sequence within your packet.

Wireshark mac address filter