CODEWITHSUNDEEP
cpcaplibpcapwifi
bengaluriga
bengaluriga

Reputation: 319

Is this a correct pcap filter expression

const char *str = "wlan subtype assoc-req or wlan subtype probe-req or wlan subtype probe-resp";
struct bpf_program fp;

if((pcap_compile(pkt_handle, &fp, str, 1, PCAP_NETMASK_UNKNOWN)==-1))
{
    pcap_perror(pkt_handle, "Compile");
}
else
    printf("filter compiled\n");

After running, the program displays "filter compiled", but it still captures Beacon frames and lots of other frames apart from the three mentioned in filter expression.

So, is it the correct filter expression to catch only assoc-req, probe-req, probe-resp frames?

Upvotes: 1

Views: 618

Answers (1)

user862787
user862787

Reputation:

As interjay said, you have to call pcap_setfilter() to make the filter take effect. (Making it an answer so that the question shows up as having an answer.)

Upvotes: 1

Related Questions