This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

WLAN fields with tshark

0

Hi, I have done some command-line capturing of WLAN packets with dumpcap. Would like to use a display filter in tshark to extract some info in a table. Have found out how to get the MAC addresses for example, but I'm looking for a full list of header fields to be able to get other things out as well.

The only thing I have come across this far is this documentation of display filter (for Wireshark, not tshark):

https://www.wireshark.org/docs/dfref/w/wlan_mgt.html https://www.wireshark.org/docs/dfref/w/wlan_aggregate.html https://www.wireshark.org/docs/dfref/w/wlan_mgt.html

Though, these filters don't work well whey I try them out in tshark. And what I get to work is not listed on these pages.

So I suspect that the filters in tshark look different than in Wireshark. Is this correct? And is there a complete list of tshark WLAN filters to find somewhere?

Thanks!

Sam

asked 05 Mar '15, 20:43

SamA's gravatar image

SamA
117713
accept rate: 0%

edited 05 Mar '15, 20:58

the fields are the same. What exactly is not working with tshark and what is your tshark version (-v)?

(06 Mar '15, 02:19) Kurt Knochner ♦

One Answer:

1

To get a complete list of fields (for all protocols, so it's very big), use:

tshark -G fields > fields.txt

answered 06 Mar '15, 02:22

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%