"Wi-Fi/WLAN Data Frames" wlan.fc.type eq 2
"Wi-Fi/WLAN Control Frames" wlan.fc.type eq 1
"Wi-Fi/WLAN Management Frames" wlan.fc.type eq 0
"Wi-Fi/WLAN Beacon Frames" wlan.fc.type_subtype == 0x0008
"No Wi-Fi/WLAN Beacon Frames" !wlan.fc.type_subtype == 0x0008
"Wi-Fi/WLAN Probe Requests" wlan.fc.type_subtype == 0x0004
"Wi-Fi/WLAN Probe Responses" wlan.fc.type_subtype == 0x0005
"Wi-Fi/WLAN Probe Request or Probe Responses" (wlan.fc.type_subtype == 0x0004)||(wlan.fc.type_subtype == 0x0005)
"Wi-Fi/WLAN Request To Send" wlan.fc.type_subtype == 0x001b
"Wi-Fi/WLAN Clear To Send" wlan.fc.type_subtype == 0x001c
"Wi-Fi/WLAN Request To Send and Clear To Send pairs" (wlan.fc.type_subtype == 0x001b)||(wlan.fc.type_subtype==0x001c)
"Wi-Fi/WLAN ACKs" wlan.fc.type_subtype == 0x001d
"Wi-Fi/WLAN QoS Data" wlan.fc.type_subtype == 0x0028
"Wi-Fi/WLAN 802.1X" llc.type == 0x888e
"Wi-Fi/WLAN Association Requests" wlan.fc.type_subtype == 0x0000
"Wi-Fi/WLAN Association Responses" wlan.fc.type_subtype == 0x0001
"Wi-Fi/WLAN Association Requests and Responses" (wlan.fc.type_subtype == 0x0000) or (wlan.fc.type_subtype == 0x0001)
"Wi-Fi/WLAN Authentication" wlan.fc.type_subtype == 0x000b
"Wi-Fi/WLAN De-Authentication" wlan.fc.type_subtype == 0x000c
"Wi-Fi/WLAN De-Authentication and Authentication" (wlan.fc.type_subtype == 0x000b) or (wlan.fc.type_subtype == 0x000c)
"Wi-Fi/WLAN EAP Authentication Frames" eapol
"Wi-Fi/WLAN Data Rate less than 4Mb/s" radiotap.datarate <= 4
"Ethernet address 00:08:15:00:08:15" eth.addr == 00:08:15:00:08:15
"Ethernet type 0x0806 (ARP)" eth.type == 0x0806
"Ethernet broadcast" eth.addr == ff:ff:ff:ff:ff:ff
"No ARP" not arp
"IP only" ip
"IP address 192.168.0.1" ip.addr == 192.168.0.1
"IP address isn't 192.168.0.1, don't use != for this!" !(ip.addr == 192.168.0.1)
"TCP only" tcp
"UDP only" udp
"Non-DNS" !(udp.port == 53 || tcp.port == 53)
"TCP or UDP port is 80 (HTTP)" tcp.port == 80 || udp.port == 80
"HTTP" http
"No ARP and no DNS" not arp and !(udp.port == 53)
"Non-HTTP and non-SMTP to/from 192.168.0.1" not (tcp.port == 80) and not (tcp.port == 25) and ip.addr == 192.168.0.1
