I am trying to use AirPcap to sniff wireless packets using t-shark but I cannot save the capture and use a filter together
So I use t-shark only to capture packets and later try to filter it using rawshark
Unfortunately the output of the command makes no sense. I am trying to sniff beacons but all I get is a set of 0's
Has anyone tried filtering using tshark or rawshark.
BTW I am trying tshark because I plan to use it in automation. Pls also suggest any better way to do so if any but by command line
So capture your beacons and then filter the capture file:
Or if you want to capture packets other than just beacons, then you can apply the display filter to the capture file afterwards:
Refer to the tshark man page for more information.
If you want to see beacon frames, please try this:
The output should look similar to this:
Try using tshark instead of rawshark, as in:
Or, if you really only want to capture beacons, you can use a capture filter to do it instead of a display filter. I can't try this command myself at the moment, but this should work:
answered 11 Jun '12, 08:47