This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi all, I'm using tshark (in Linux) to return only packet source MAC addresses and signal strength. Here's what I use:

tshark -i wlan0 -T fields -e wlan.sa -e radiotap.dbm_antsignal

The problem is that every few packets is prefixed by an annoying ID number. I assume that these are the same as the numbers that show up unpredictably when I run "tshark -i wlan0 -n" and get this output (I've x'd out actual addresses...):

Capturing on 'wlan0'

1 0.000000 00:02:6f:xx:xx:xx -> ff:ff:ff:ff:ff:ff

2 0.131605 00:18:d1:xx:xx:xx -> ff:ff:ff:ff:ff:ff

3 0.204522 00:02:6f:xx:xx:xx -> ff:ff:ff:ff:ff:ff

4 0.228617 -> 00:18:d1:xx:xx:xx (RA)

4 5 0.336334 00:18:d1:xx:xx:xx -> ff:ff:ff:ff:ff:ff

6 0.409324 00:02:6f:xx:xx:xx -> ff:ff:ff:ff:ff:ff

7 0.447556 -> 20:16:d8:xx:xx:xx (RA)

8 0.541174 00:18:d1:xx:xx:xx -> ff:ff:ff:ff:ff:ff

9 0.649089 -> 20:16:d8:xx:xx:xx (RA)

10 0.665628 06:02:6f:xx:xx:xx -> ff:ff:ff:ff:ff:ff

11 0.746025 00:18:d1:xx:xx:xx -> ff:ff:ff:ff:ff:ff

11 12 0.768025 06:02:6f:xx:xx:xx -> ff:ff:ff:ff:ff:ff

Notice the extra "4" and "11" Does anyone have any idea what these extra numbers are and, more importantly, how I can suppress them in my output? Thanks

asked 06 May '14, 09:15

dlanced's gravatar image

dlanced
11113
accept rate: 0%


See my answer to this question.

permanent link

answered 06 May '14, 09:22

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

Darn. I'm using 1.10.6-1 from the Ubuntu 14.04 repository and I'd like to stay within their upgrade cycle, so I'd rather not build my own. Is there an existing bug report asking for a backport? Thanks!

(06 May '14, 09:29) dlanced

Is there an existing bug report asking for a backport?

Not that I'm aware of, but you can browse/search the open bugs and open one if there's not already one open.

(06 May '14, 09:43) cmaynard ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×22
×2

question asked: 06 May '14, 09:15

question was seen: 1,572 times

last updated: 06 May '14, 09:47

p​o​w​e​r​e​d by O​S​Q​A