TABLE OF CONTENTS Regardless of whether you are reading a packet capture from a stored file or from a live interface on a Windows or Linux host, Wireshark s analysis features are nearly identical. Wireshark offers many useful features for analyzing wireless traffic, including detailed protocol dissectors, powerful display filters, customizable display properties, and the ability to decrypt wireless traffic. Each of these features are examined in detail.
One of the most impressive Wireshark features is the ability to dissect the contents of traffic and present it in a collapsible tree-like manner. For wireless traffic, Wireshark presents the Frame Dissector window starting with frame statistics, and then the 802.11 MAC layer contents. If additional data follows for the 802.11 header, Wireshark logically divides each of the protocols that follow into a new window.
The first group in the Packet Details window detailed summary information about the currently selected frame. The Frame window doesn t display any of the selected frame s contents, but rather general information contained in the packet capture for the selected frame (see Table 6.3).
| Field Name | Description | Display Filter Reference Name |
|---|---|---|
| Arrival Time | The Arrival Time reflects the timestamp recorded by the station that is capturing traffic when the packet arrived. The accuracy of this field is only as accurate as the time on the receiving station. Note that packet captures from Windows systems are only represented with accuracy in seconds; no support... |
