CWAP: Certified Wireless Analysis Professional v402 — Question 4

When using Wireshark for protocol analysis, what filter will allow you to see only beacon frames?

Answer options

• A. wlan.fc.type_subtype = =0x05
• B. wlan.fc.type_subtype = =0x0b
• C. wlan.fc.type_subtype = =0x08
• D. wlan.fc.type_subtype = =0x04

Correct answer: C

Explanation

The correct answer is C, as beacon frames are identified by the subtype value of 0x08 in the WLAN frame control field. Options A, B, and D correspond to different types of frames: 0x05 is for RTS, 0x0b is for probe responses, and 0x04 is for acknowledgement frames, making them incorrect for filtering beacon frames.