wlan.bssid eq 00:11:92:6e:cf:00 only listen to one specific access point wlan.fc.type_subtype != 0x08 hide beacon frames (see p35 of http://www.willhackforsushi.com/books/377_eth_2e_06.pdf for more information on the subtypes) wlan.fc.type == 2 data frames only wlan.fc.type == 2 and wlan.fc.subtype != 4 data frames only, exclude NULL frames !wlan.fc.protected unencrypted frames only