This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Tshark: suppress random line numbers

0

Hi all, I'm using tshark (in Linux) to return only packet source MAC addresses and signal strength. Here's what I use:

tshark -i wlan0 -T fields -e wlan.sa -e radiotap.dbm_antsignal

The problem is that every few packets is prefixed by an annoying ID number. I assume that these are the same as the numbers that show up unpredictably when I run "tshark -i wlan0 -n" and get this output (I've x'd out actual addresses...):

Capturing on 'wlan0'

1 0.000000 00:02:6f:xx:xx:xx -> ff:ff:ff:ff:ff:ff

2 0.131605 00:18:d1:xx:xx:xx -> ff:ff:ff:ff:ff:ff

3 0.204522 00:02:6f:xx:xx:xx -> ff:ff:ff:ff:ff:ff

4 0.228617 -> 00:18:d1:xx:xx:xx (RA)

4 5 0.336334 00:18:d1:xx:xx:xx -> ff:ff:ff:ff:ff:ff

6 0.409324 00:02:6f:xx:xx:xx -> ff:ff:ff:ff:ff:ff

7 0.447556 -> 20:16:d8:xx:xx:xx (RA)

8 0.541174 00:18:d1:xx:xx:xx -> ff:ff:ff:ff:ff:ff

9 0.649089 -> 20:16:d8:xx:xx:xx (RA)

10 0.665628 06:02:6f:xx:xx:xx -> ff:ff:ff:ff:ff:ff

11 0.746025 00:18:d1:xx:xx:xx -> ff:ff:ff:ff:ff:ff

11 12 0.768025 06:02:6f:xx:xx:xx -> ff:ff:ff:ff:ff:ff

Notice the extra "4" and "11" Does anyone have any idea what these extra numbers are and, more importantly, how I can suppress them in my output? Thanks

asked 06 May '14, 09:15

dlanced's gravatar image

dlanced
11113
accept rate: 0%


One Answer:

1

See my answer to this question.

answered 06 May '14, 09:22

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

Darn. I'm using 1.10.6-1 from the Ubuntu 14.04 repository and I'd like to stay within their upgrade cycle, so I'd rather not build my own. Is there an existing bug report asking for a backport? Thanks!

(06 May '14, 09:29) dlanced

Is there an existing bug report asking for a backport?

Not that I'm aware of, but you can browse/search the open bugs and open one if there's not already one open.

(06 May '14, 09:43) cmaynard ♦♦