Hi, I want to use rawshark to read packets from pipe and print some useful information for me. Here's the scenario. 1. Remote machine with wireless interface in monitor mode capturing with tcpdump and pipe to netcat 2. Another remote machine read from machine 1 netcat stream and pipes data to rawshark 3. rawshark have to output parsed information in useful for me format. So far I try to pipe previous captured data (local file) to rawshark and it's fine (cat test.pcap | rawshark -s -r - -d encap:105). But I can't find the right value for the '-F' flag to make it display package source mac address and radiotap header information like signal strength. I was trying with -F wlan.sa -F radiotap.dbm_antsignal asked 30 Dec '12, 02:25 nerform |
One Answer:
Please try this:
It works with this sample file.
If it does not work with your capture, then your version of tcpdump does not provide a radiotap header. Regards answered 30 Dec '12, 14:44 Kurt Knochner ♦ |
Thank you very much Kurt. It works!