This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to count different source address in 802.11 protocol

0

I want to count different source address in 802.11 protocol, and set "wlan.fc.subtype eq 0 and wlan.fc.type eq 0" as the display filter. The problem is how to count?

asked 08 Apr '14, 02:07

metamatrix's gravatar image

metamatrix
56●16●16●19
accept rate: 100%

One Answer:

0

You can try this command:

tshark -r file.pcap -R "wlan.fc.subtype eq 0 and wlan.fc.type eq 0" -T fields -e wlan.sa | sort | uniq -c | sort -nr

answered 08 Apr '14, 12:32

Roland's gravatar image

Roland
764●2●4●15
accept rate: 13%

edited 08 Apr '14, 12:32