So from checking here it seems that the current build of tshark that runs on RasPi does not support the wlan.sa_resolved field for MAC name resolution. Is there any way around this? A manual install version that will run on a Raspberry Pi perhaps? asked 22 Mar '15, 03:05  youcloudsofddom |
2 Answers:
Sounds like the maintainer of the Raspberry Pi package for tshark did not include the manufacturers file (maybe to keep the package small). Perhaps it is enough to copy the "manuf" file from your mac to the Raspberry Pi to the global preferences directory (search for the cfilters, dfilters and colorfilters files if you're not sure which directory contains the global preferences). answered 24 Mar '15, 13:43  SYN-bit ♦♦ manuf is right there, from libwireshark-data, in /usr/share/wireshark/. The problem is that the dissector of his version of tshark doesn't have that field. (25 Mar '15, 09:30) Jaap ♦ Oops, you're right. I did not bother to check https://www.wireshark.org/docs/dfref/w/wlan.html (25 Mar '15, 12:05) SYN-bit ♦♦ |
If I check the Raspbian repository I see that they have a package for Wireshark 1.12.1 (including tshark), of which the wireless LAN dissector has this field. What would be needed, with respect to required other packages, I do not know. I may require a more extensive upgrade (to jessie/testing maybe). That is depending on the distribution. answered 25 Mar '15, 09:33  Jaap ♦ |
what is you tshark version on the Pi (tshark -v)?
@Kurt Knochner It's 1.8.2