Hi , I am trying to use AirPcap to sniff wireless packets using t-shark but I cannot save the capture and use a filter together So I use t-shark only to capture packets and later try to filter it using rawshark Unfortunately the output of the command makes no sense. I am trying to sniff beacons but all I get is a set of 0’s Has anyone tried filtering using tshark or rawshark. BTW I am trying tshark because I plan to use it in automation. Pls also suggest any better way to do so if any but by command line Regards TroubledUser asked 10 Jun ‘12, 23:30  Trouble User edited 11 Jun ‘12, 08:44  Kurt Knochner ♦ |
3 Answers:
So capture your beacons and then filter the capture file:
Or if you want to capture packets other than just beacons, then you can apply the display filter to the capture file afterwards:
Refer to the tshark man page for more information. answered 12 Jun '12, 09:23  cmaynard ♦♦ edited 12 Jun '12, 09:26 |
If you want to see beacon frames, please try this:
The output should look similar to this:
Regards answered 11 Jun '12, 08:43 Kurt Knochner ♦ edited 11 Jun '12, 08:44 |
Try using tshark instead of rawshark, as in: Or, if you really only want to capture beacons, you can use a capture filter to do it instead of a display filter. I can't try this command myself at the moment, but this should work: Unfortunately, the pcap-filter man page is not yet accessible from tcpdump's website, but you can reference it here instead: http://www.manpagez.com/man/7/pcap-filter/. For more helpful filtering tips related to this topic, you might also refer to Joke Snelder's "Wireless Display and Capture Filters Samples" article on lovemytool. answered 11 Jun '12, 08:47 cmaynard ♦♦ |
Hi Fellow techies ,
Thanks for your replies but it still does not solve my problem .
I still need to know how to filter packets from the capture file because once I get a capture of beacons , based on my script I may need to filter more paramters . I cannot re-run t-shark because I need a single sample of packets and then run multiple filters on them.
To quote an example : 1. I get a capture of 500 beacon packets 2. From 500 Beacons I need to check configurations of 4 “SSID” like beacon interval , capability info 3. So I cannot re-run t-shark 4 times because I am doing some changes on the AP and want to capture the info on all 4 SSID simultaneously.
So your solution on capturing packets holds true if capture needed is only beacons. But here within beacon packets I need 4 Different SSID and their info. I wish to know how to apply a filter to a capture file
Regards Troubled User