tshark won’t display eth.addr

Question

Here's my command:

tshark -i iface -o wlan.enable_decryption:TRUE -2 -R ip -T fields -e eth.dst -e ip.src -e ip.len

Actually the -R is "ip && !ip == 192.168.0.0/24" but the code display here seems bent on replacing '&' with html entities.

Anyway, I have WPA credentials in ~/.wireshark/80211_keys and this works for nodes that subsequently connect to the network, but the first field (eth.dst) is always blank. I've also tried eth.addr, same thing.

How can I get what I want here, namely, the destination MAC address, the IP source address, and the packet length?

Accepted Answer

but the first field (eth.dst) is always blank. I've also tried eth.addr, same thing.

which is totally normal, if you are looking at wifi/wlan traffic, as it does not have an ethernet header.

Please try one of the following fields:

-e wlan.addr -e wlan.ra -e wlan.sa -e wlan.ta -e wlan.da

For more details, please check the following link:

https://www.wireshark.org/docs/dfref/w/wlan.html

Regards
Kurt