hcxdumptool and the Berkeley Packet Filter

[ZerBea]

The Berkeley Packet Filter (BPF) is a network tap and packet filter which permits computer network packets to be captured and filtered at the operating system level. Main purpose is to filter a goal to be protected or a goal to be attacked. Unwanted frames can be filtered, too.
https://en.wikipedia.org/wiki/Berkeley_Packet_Filter
The filter syntax is similar to the filter syntax of tshark and Wireshark or tcpdump.
$ man pcap-filter
https://tshark.dev/capture/capture_filters/

To protect a station [AP(s) and/or CLIENT(s)] or to attack a station [APs and/or CLIENT(s)] it is mandatory to create a BPF and to apply it to hcxdumptool. The work flow is to build the BPF is always the same:

Step1:
write filter code in high level syntax (same syntax like the capture filters of tshark, Wireshark and tcpdump)

Step 2:
compile the filter code (either use hcxdumptool's build in BPF compiler or use tcpdump's filter compiler as mentioned in -h and --help

Step 3:
apply filter to hcxdumptool (--bpf=)

To create a BPF it is mandatory to understand 802.11 protocol (frame types and address fields) and is mandatory to analyze the traffic to get all the necessary information to create it.

A BPF is merciless and wrong filter options cause that hcxdumptool does not work as expected.
A BPF is not comparable to aircrack-ng BSSID options.

high level syntax (limited instruction set, but user friendly, simple and easy to use if you are familiar with tshark, Wireshark or tcpdump):

"wlan addr3 112233445566"

c style syntax (unlimited instruction set, good knowledge in programming with C is mandatory):

{ 0x30, 0, 0, 0x00000003 },
{ 0x64, 0, 0, 0x00000008 },
{ 0x7, 0, 0, 0x00000000 },
{ 0x30, 0, 0, 0x00000002 },
{ 0x4c, 0, 0, 0x00000000 },
{ 0x2, 0, 0, 0x00000000 },
{ 0x7, 0, 0, 0x00000000 },
{ 0x50, 0, 0, 0x00000000 },
{ 0x54, 0, 0, 0x0000000c },
{ 0x15, 5, 0, 0x00000004 },
{ 0x40, 0, 0, 0x00000012 },
{ 0x15, 0, 3, 0x33445566 },
{ 0x48, 0, 0, 0x00000010 },
{ 0x15, 0, 1, 0x00001122 },
{ 0x6, 0, 0, 0x00000400 },
{ 0x6, 0, 0, 0x00000000 },

low level assembler code (unlimited instruction set, extensive knowledge in programming with ASM is mandatory):

(000) ldb      [3]
(001) lsh      #8
(002) tax      
(003) ldb      [2]
(004) or       x
(005) st       M[0]
(006) tax      
(007) ldb      [x + 0]
(008) and      #0xc
(009) jeq      #0x4             jt 15	jf 10
(010) ld       [x + 18]
(011) jeq      #0x33445566      jt 12	jf 15
(012) ldh      [x + 16]
(013) jeq      #0x1122          jt 14	jf 15
(014) ret      #1024
(015) ret      #0

This is the royal class of creating a BPF.