As the whole traffic (except handshake) was encrypted it was not possible to guess who was sending those packets. At first, I only recorded traces in Wireshark and filtered them ( = 'TLS 1.0'):Īpparently, the requests were there. I needed to locate a process on a Virtual Machine (local address 10.0.2.5) which was still using TLSv1 to connect to our load balancer. And sometimes this information is necessary to investigate the problem you are facing. Use the following combination to show the wireless sent to a wireless client without retransmissions : (wlan.fc.retry = 0) & (wlan.ra = )Īnd to show with retransmissions : (wlan.fc.retry = 1) & (wlan.By default when you record a trace in Wireshark, you won’t find process IDs in it.

Use 1 to show the retransmissions : wlan.fc.retry = 1 To show the WLAN Frame has been transmitted without re-transmission : wlan.fc.retry = 0 = 7 - Network Control (Voice)Ĭheck retransmissions : įilter on Association Frames : wlan.fc = 0x0000įilter on Probe Request : wlan.fc = 0x4000įilter on Probe Response : wlan.fc = 0x5000įilter on Wildcard Probe Requests and Response : = 0.On seeing the above I decided to filter just on the Priority Field under the QoS Control: Then looking at the screenshot it shows when you expand the QoS Control under the QoS Data Field that it is best effort To filter the frames just to show the QoS data frames use the following filter : wlan.fc.type_subtype = 0x0028.Looking at an example of a QoS data Frame:

For reference there is the official page on Wireshark Link : During the reading of CWNA and looking at packet capture there are some useful filters that can be used.

Wireshark filter wildcard