Hi, Is there a way to make MAC address resolution work in tshark output? I use this command:
And the output lines looks like the line below:
I cannot get the mac address resolved using global manuf file when -Tfields is used with -e. In wireshark or regular tshark output I see 'Ericsson_30:3c:1c' instead of 00:0d:67:30:3c:1c'. Perhaps I am missing something. In general, is there anyway to format the field output? E.g to have a similar content as Wireshark shows? In the example above, tshark when used with -Tfield prints wlan.fc.type_subtype as numerical value 0x08 for a Beacon frame. If I create a column in wireshark for this field I will see the string 'Beacon' (and same if I export it to CSV). Is there a way to get the same from tshark using -Tfield/-e options? Many thanks for help, Arezoo asked 08 Mar '13, 11:58 Arezoo |