This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I am trying to use Tshark to analyze network traffic to find probe requests on a wifi card in monitor mode. I would like to use tshark to analyze traffic than output the data into a csv file. I can capture the data in real time with:

tshark -i wlan1 -f "type mgt subtype probe-req"

but if i try and use:

-i wlan1 -f "type mgt subtype probe-req" -T fields -e frame.number -e wlan.sa ...(every mac/ip filter i could find) -E separator=,

all i get is the frame number. Am i using the -T field/-e fields commands wrong or am i missing something?

asked 11 Jul '17, 10:32

20weegweeg's gravatar image

20weegweeg
6112
accept rate: 0%

edited 11 Jul '17, 10:54

sindy's gravatar image

sindy
6.0k4851

Do you experience the same issue if you use

tshark -i wlan1 -f "type mgt subtype probe-req" -w my_file

tshark -r my_file -T fields -e frame.number -e wlan.sa -E separator=,

?

(11 Jul '17, 10:58) sindy

What version of Wireshark is this?

./tshark -i en0 -I -T fields -e frame.number -e wlan.sa -f "type mgt subtype probe-req" -E separator=,

printed

1,{MAC address 1}
2,{MAC address 1}
3,{MAC address 1}
4,{MAC address 2}
5,{MAC address 2}

on my MacBook Pro with a build from a recent checkout of the master branch.

permanent link

answered 11 Jul '17, 18:54

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

I installed the latest build and now it works, thanks for the help

(12 Jul '17, 07:04) 20weegweeg
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×349
×2

question asked: 11 Jul '17, 10:32

question was seen: 910 times

last updated: 12 Jul '17, 07:06

p​o​w​e​r​e​d by O​S​Q​A