This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

A WLAN capture executed in monitor mode shows lots of wireless retransmissions occuring. Editcap is not able to remove the duplicates since the packets are not actually duplicates, the radiotap header changes for each packet. Could it be possible to improve editcap to specify from which header the duplicate analysis should be done? E.g. look for duplicates while ignoring header X,Y,Z (in decapsulation order). I filed bug 8511 but would like to have some input from the community.

asked 21 Mar '13, 12:24

yul_analyzer's gravatar image

yul_analyzer
6558
accept rate: 0%


Yes, that would be possible, but the code needs to be written by someone taking an interest in this functionality.

permanent link

answered 21 Mar '13, 13:07

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

Regarding the specific issue of ignoring/removing wireless retransmissions, the tshark "-y RAW" option will not capture the radiotap header hence creating real duplicates for retransmissions that can be easily removed with editcap afterwards.

(22 Mar '13, 06:39) yul_analyzer
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×114
×104
×41

question asked: 21 Mar '13, 12:24

question was seen: 1,862 times

last updated: 22 Mar '13, 06:46

p​o​w​e​r​e​d by O​S​Q​A