Ask Your Question
0

tshark: '-T fields' - Missing MACs in output

asked 2020-06-25 09:24:57 +0000

bor gravatar image

When I read 802.11-MAC-Data, I got gaps. This is no problem when staying on one channel, but I use channel-hopping, so after changing the channel I often miss a lot of information.

Is there a way to display the MACs in these gaps when using the '-T fields' option?

tshark -I -i wlan1 -a duration:60 -w capture.bin
tshark -r capture.bin -T fields -e wlan_radio.channel -e wlan.sa -e wlan.bssid

...
10      00:07:50:fc:a0:0a       00:07:50:fc:a0:0a
11
11
11
11
11
11
11
11
11
11
11      bc:30:7d:53:10:4a       bc:30:7d:53:10:4a
...
10      00:07:50:fc:a0:0a       00:07:50:fc:a0:0a
10      00:07:50:fc:a0:0a       00:07:50:fc:a0:0a
11
11
11      3a:43:1d:66:46:76       3a:43:1d:66:46:76
...
edit retag flag offensive close merge delete

Comments

To hide the lines w/ empty fields is no prob. But this fields belongs to a device and produces e.g, RSSI or wlan.fc.type_subtype.

If you use '-T ek', the missing MACs are displayed.

bor gravatar imagebor ( 2020-06-25 09:55:46 +0000 )edit

Can you share the capture with the issue?

grahamb gravatar imagegrahamb ( 2020-06-25 10:10:32 +0000 )edit

You are right, I'm wrong. I used a wrong file.

Tx 4 support!

bor gravatar imagebor ( 2020-06-25 13:47:26 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2020-06-25 09:35:09 +0000

grahamb gravatar image

The gaps are likely to be because the required fields are not present in those packets. You could apply a display filter to only show packets that have the required fields, e.g. -Y wlan.sa and wlan.bssid.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2020-06-25 09:24:57 +0000

Seen: 238 times

Last updated: Jun 25 '20