Hi all, I have 3 laptops with wireless NIC's which are configured and associated to work in Infrastructure mode. Data will get transferred between 2 laptops which i need to capture from the 3rd laptop. When the data is transferring between the two laptops i am running the tcpdump command in the 3rd laptop setting the card to monitor mode with the filter expression "wlan host MAC address of 1st laptop or wlan host MAC address of 2nd laptop or wlan host MAC address of the AP to which both are associated. tcpdump is displaying beacons and all the data packets but it is not displaying the ACK frames which will be there for every data packet. I really dont know what filter expressions to give to capture all the data transfer and ack's for that. I dont want to see any other packets in the air other than packets sent from my 2 laptops and the AP to which they are associated. Can anyone help me regarding setting the filter expression for this scenario,
Thanks in advance, Shantha - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
