<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Analyzing 802.11 Frame Captures — API & Tool Reference

> Quick reference for tools, commands, and APIs used in analyzing-802.11-frame-captures.

## Tools


### `tshark`

Terminal-based protocol analyzer

**Usage:**
```bash
tshark -r <capture> -Y <filter>
```

**Key Flags:**
  - `-r: read capture file`
  - `-Y: display filter`
  - `-T fields: field extraction`
  - `-q -z: statistics`

---

### `editcap`

Capture file editor

**Usage:**
```bash
editcap -A <start> -B <end> <in> <out>
```

**Key Flags:**
  - `-A: start time`
  - `-B: end time`
  - `-c: split by packet count`
  - `-d: remove duplicates`

---

### `mergecap`

Merge multiple capture files

**Usage:**
```bash
mergecap -w <output> <input1> <input2>
```

**Key Flags:**
  - `-w: output file`
  - `-a: append mode`

---

### `capinfos`

Capture file information tool

**Usage:**
```bash
capinfos <capture>
```

**Key Flags:**
  - `-c: packet count`
  - `-d: duration`
  - `-s: file size`
  - `-e: encapsulation`

---


## Integration Notes

- All tools should be run with least-privilege access appropriate to the task
- Log all tool invocations for audit trail
- Validate tool output before acting on results
- Cross-reference findings with multiple tools where possible

## See Also

- Parent skill: [Wireless Security](../../../SKILL.md)
- Technique SKILL.md: [../SKILL.md](../SKILL.md)
