握手包

1
sudo tcpdump "ether proto 0x888e and ether host 路由器MAC" -I -U -vvv -i en0 -w handshake.cap

beacon

1
sudo tcpdump "type mgt subtype beacon and ether src 路由器MAC" -I -c 1 -i en0 -w beacon.cap

合并

1
mergecap -a -F pcap -w capture.cap beacon.cap handshake.cap