Ask Your Question
0

How can I filter a column to show only one instance of each wep initialization vector found?

asked 2017-11-11 06:24:29 +0000

reedfrey gravatar image

For an assignment, I have to decipher how many unique wep initialization vectors there are. I have added the column to the packet list viewer, and have sorted from least to greatest, but now I need a count of how many "unique" IV's there are. I know tshark can be used, but I want to do this directly inside WireShark.

Thank you.

edit retag flag offensive close merge delete

Comments

I don't think that's possible in Wireshark apart from sorting by that column and physically counting the different values.

grahamb gravatar imagegrahamb ( 2017-11-12 16:25:13 +0000 )edit

HI reedfrey,

Do you happen to know how to enable Initialization vector via cli with TSHARK? Can you help with this?

Praneeth Thodeti gravatar imagePraneeth Thodeti ( 2024-03-08 10:03:56 +0000 )edit
add a comment

1 Answer

Sort by ยป oldest newest most voted
0

answered 2024-03-08 13:29:00 +0000

Chuckc gravatar image

a count of how many "unique" IV's there are

This is available in the 4.3.0 development builds in the automated build section of our download area.

Added in 14330: Allow any field expression syntax to be used in columns for issue 15990: Allow the use of display filter functions in column definitions.

A column can be added with definition count(wlan.wep.iv).

edit flag offensive delete link more

Comments

While the new column features are really great, they won't help in this case, as each packet will only have one IV, so the count will always be 1. A Lua script migt help out here, but then a tshark command is much easier:

sake@Mac16:~/Downloads$ tshark -r wep-crack.pcap -T fields -e wlan.wep.iv | sort -u | wc -l
   17315
sake@Mac16:~/Downloads$

Pcap file downloaded from here

SYN-bit gravatar imageSYN-bit ( 2024-03-10 07:57:00 +0000 )edit
add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

subscribe to rss feed

Stats

Asked: 2017-11-11 06:24:29 +0000

Seen: 2,377 times

Last updated: Mar 08