Can’t export mac address as CSV

Question

I am trying to use Tshark to analyze network traffic to find probe requests on a wifi card in monitor mode. I would like to use tshark to analyze traffic than output the data into a csv file. I can capture the data in real time with:

tshark -i wlan1 -f "type mgt subtype probe-req"

but if i try and use:

-i wlan1 -f "type mgt subtype probe-req" -T fields -e frame.number -e wlan.sa ...(every mac/ip filter i could find) -E separator=,

all i get is the frame number. Am i using the -T field/-e fields commands wrong or am i missing something?

Answer 1

What version of Wireshark is this?

./tshark -i en0 -I -T fields -e frame.number -e wlan.sa -f "type mgt subtype probe-req" -E separator=,

printed

1,{MAC address 1}
2,{MAC address 1}
3,{MAC address 1}
4,{MAC address 2}
5,{MAC address 2}

on my MacBook Pro with a build from a recent checkout of the master branch.