Exam CWAP-402 topic 1 question 23 discussion

wlan.fc.type_subtype == 0x8 is the expression which we need to add in the filter box. The reason why we are comparing it with 0x8 is, beacons are part of the management frames which has the type field set to 0 and beacons are represented by a hex value of 0x8 i.e there sub-type is 8. We can change the sub-type alone and map them to any one of the other management frames. For example the above filter can be modified to show only probe request frames with this expression wlan.fc.type_subtype == 0x5 and wlan.fc.type_subtype == 0x6 goes for probe response frames.