Blank output when applying reading filter

Question

My ncap file is displayed properly without any filter

tshark -r myfile.ncap
1 0.000000 ArrisGro_16:a0:14 → AskeyCom_9a:2b:a1 802.11 400 QoS Data, SN=2900, FN=0,
2 0.000234 ArrisGro_16:a0:14 → AskeyCom_9a:2b:a1 802.11 400 QoS Data, SN=2900, FN=0, 
[...]

However, when applying a filter, tshark does not output any line:

tshark -r myfile.ncap -Y eth.addr_resolved==ArrisGro_16:a0:14

Why is there no output when I apply the filter?

Answer 1

0

Why is there no output when I apply the filter?

Because there is no eth field in your wlan (802.11) frames, and thus no frame can match the display filter expression.

Use tshark -r myfile.ncap -Y wlan.addr_resolved==ArrisGro_16:a0:14 instead.

permanent link

answered 01 Nov '16, 01:59

sindy
6.0k●4●8●51
accept rate: 24%

Blank output when applying reading filter

Follow this question

You have a trillion packets.

You need to see four of them.

Don't have Wireshark?

Related questions