PCAP Workflow: Capture on Flipper, Analyze in Wireshark

Why Move Captures to Wireshark

Flipper's small screen is fine for live monitoring but genuinely limited for deep packet analysis — Wireshark gives you filtering, protocol dissection, statistics, and the ability to actually dig into frame contents at a level Flipper's UI was never meant to provide.

Capturing to PCAP on the Dev Board

With Marauder firmware (see setup guide), most Sniff modes support a "Save PCAP" option that writes captures in standard PCAP format to the Dev Board's SD card (if the Dev Board variant you have includes one) or to Flipper's own storage depending on your firmware build's configuration:

1. Start the relevant Sniff mode (beacon, probe, deauth detection, or general capture depending on what you're investigating).
2. Enable PCAP saving from the mode's options before or during capture.
3. Let it run for your needed capture window, then stop.

Getting the File Off the Device

• If saved to an SD card on the Dev Board itself, remove the card and read it directly via a card reader on your computer.
• If saved to Flipper's storage, connect via qFlipper (desktop companion app) and browse to the file location to copy it off — same mechanism as pulling Sub-GHz/IR captures.

Opening in Wireshark

File > Open, select the .pcap file — Wireshark will parse and display it as a standard packet capture, fully compatible with any other PCAP source (this is a genuinely standard, widely-supported format, not something Flipper-specific).

Useful Wireshark Filters for WiFi Captures

• wlan.fc.type_subtype == 0x08 — beacon frames only
• wlan.fc.type_subtype == 0x04 — probe requests only
• wlan.fc.type_subtype == 0x0c — deauth frames (useful for confirming detection during your own network's PMF testing)
• wlan.ssid == "YourNetworkName" — filter to a specific network's traffic within a mixed capture

What You Can Learn From the Analysis

• Channel utilization and congestion patterns over your capture window (Statistics > WLAN Traffic in Wireshark gives a clean summary view)
• Signal strength trends if your capture includes RSSI data — useful for troubleshooting weak coverage spots
• Confirming specific frame types are/aren't present — e.g. verifying PMF is actually rejecting forged deauth on your network, following up on the deauth defense guide's testing

Keeping This Legal

Same rule as everywhere else in this series — capture and analyze traffic on your own network/equipment, or under explicit authorization for a professional engagement. The PCAP format and Wireshark analysis technique are neutral tools; the legality is entirely about whose network you're pointing them at.