Others change different bytes in the MAC address so we would have to reverse engineer this pattern, then work up some display filters that are consistent with these platforms. There are techniques, but you have to figure out how your platform assigns BSSIDs to the various SSIDs - it's a common misconception that they all just change the last byte. If, as you ask, you want to know how many actual clients are connected to a given AP, regardless of SSID, then it can be tricky. If you only care about who is connected to a particular SSID, then the above is fine. If you happen to have more than one SSID hosted on an AP, then it depends on what you want. If you have a single SSID configured, find the BSSID and filter for this the endpoints tool, with 'limit to display filter' and selecting for 802.11, is useful here.Īnd for the Endpoints tool, see Statistics -> Endpoints

It was shared as image file so I decided add different filters together and type here so people can just copy paste the filters instead having to type again themselves. These display filters are already been shared by clear to send. The harder way is to use a wireless packet capture. Wireshark has two filtering languages: One used when capturing packets, and one used when displaying packets. Sometimes, even standalone APs will tell about all the clients connected. The easiest answer is to use a managed wifi infrastructure and it will likely just tell you how many clients are currently connected to an AP and the whole system (if you have more than one AP).

Pcap wireshark filter ssid