First of all, I'm monitoring my wifi network in monitor/promiscuous mode. On my Mac I have wireshark / tshark v1.10.1 On a debian machine I have tshark 1.10.2 I noticed that on my Mac I can capture "radiotap.dbm_antnoise" which is the antenna noise, but on my debian machine it does not show up (whether I capture as an XML file or specify "radiotap.dbm_antnoise") I was originally running an older version of tshark that I'd installed from aptitude, thought that was the problem, so I uninstalled that and just finished compiling 1.10.2 from source (which didn't help). This is the command I'm running: sudo tshark -I -i myinterface -Y "wlan.fc.type_subtype == 0x04" -T fields -E separator=, -E quote=d -e "wlan.sa" -e "frame.time_epoch" -e "radiotap.dbm_antsignal" -e "radiotap.dbm_antnoise" Here are the results: On my Mac: Capturing on 'Wi-Fi' "e1:c2:df:f9:33:07","1377713656.454545000","-71","-88" (looks OK) But on the debian machine: Capturing on 'wlan0' "a4:d1:d2:e5:86:d0","1377713603.090254000","-87", (Notice how the last field is empty) Does anyone know why this could be happening? Thanks! asked 28 Aug '13, 11:18  jjardine edited 28 Aug '13, 11:22 |
One Answer:
This field will be present only if your Wifi adapter on your Linux box does provide this information. My guess is that your adapter does not support this metric. This can be checked with the radiotap.present.dbm_antnoise value. answered 28 Aug '13, 11:30  Pascal Quantin |
Thanks! That makes sense. I guess I will try to find a better device for my Linux box.
For the record, this is what my adapter shows up as under lsusb:
Bus 001 Device 003: ID 148f:5370 Ralink Technology, Corp. RT5370 Wireless Adapter
and also no luck with this guy:
Bus 001 Device 014: ID 0bda:8178 Realtek Semiconductor Corp. RTL8192CU 802.11n WLAN Adapter