This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

So from checking here it seems that the current build of tshark that runs on RasPi does not support the wlan.sa_resolved field for MAC name resolution. Is there any way around this? A manual install version that will run on a Raspberry Pi perhaps?

asked 22 Mar '15, 03:05

youcloudsofddom's gravatar image

youcloudsofddom
16559
accept rate: 0%

what is you tshark version on the Pi (tshark -v)?

(23 Mar '15, 09:58) Kurt Knochner ♦

@Kurt Knochner It's 1.8.2

(23 Mar '15, 15:52) youcloudsofddom

Sounds like the maintainer of the Raspberry Pi package for tshark did not include the manufacturers file (maybe to keep the package small). Perhaps it is enough to copy the "manuf" file from your mac to the Raspberry Pi to the global preferences directory (search for the cfilters, dfilters and colorfilters files if you're not sure which directory contains the global preferences).

permanent link

answered 24 Mar '15, 13:43

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

manuf is right there, from libwireshark-data, in /usr/share/wireshark/. The problem is that the dissector of his version of tshark doesn't have that field.

(25 Mar '15, 09:30) Jaap ♦

Oops, you're right. I did not bother to check https://www.wireshark.org/docs/dfref/w/wlan.html

(25 Mar '15, 12:05) SYN-bit ♦♦

If I check the Raspbian repository I see that they have a package for Wireshark 1.12.1 (including tshark), of which the wireless LAN dissector has this field. What would be needed, with respect to required other packages, I do not know. I may require a more extensive upgrade (to jessie/testing maybe). That is depending on the distribution.

permanent link

answered 25 Mar '15, 09:33

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×12
×9

question asked: 22 Mar '15, 03:05

question was seen: 1,987 times

last updated: 25 Mar '15, 12:05

p​o​w​e​r​e​d by O​S​Q​A