Blank output when applying reading filter

Question

My ncap file is displayed properly without any filter

tshark -r myfile.ncap
1 0.000000 ArrisGro_16:a0:14 → AskeyCom_9a:2b:a1 802.11 400 QoS Data, SN=2900, FN=0,
2 0.000234 ArrisGro_16:a0:14 → AskeyCom_9a:2b:a1 802.11 400 QoS Data, SN=2900, FN=0, 
[...]

However, when applying a filter, tshark does not output any line:

tshark -r myfile.ncap -Y eth.addr_resolved==ArrisGro_16:a0:14

Why is there no output when I apply the filter?

Answer 1

Why is there no output when I apply the filter?

Because there is no eth field in your wlan (802.11) frames, and thus no frame can match the display filter expression.

Use tshark -r myfile.ncap -Y wlan.addr_resolved==ArrisGro_16:a0:14 instead.