Wireshark-users: Re: [Wireshark-users] What filter value in -e will tell me the Channel an SSID i
What about:
tshark -r 0601.pcap -T fields -e frame.number -e wlan_mgt.ssid -e radiotap.channel.freq
-E header=y -E separator=, > 0601.csv
Useful links:
http://www.wireshark.org/docs/dfref/
http://www.wireshark.org/docs/dfref/r/radiotap.html
http://www.wireshark.org/docs/dfref/w/wlan.html
Or use TShark with the option -G:
$ tshark -G | grep radiotap.channel
F Channel radiotap.channel FT_UINT32 radiotap 802.11
channel number that this frame was sent/received on
F Channel frequency radiotap.channel.freq FT_UINT32 radiotap
Channel frequency in megahertz that this frame was sent/received
on
etc.
http://www.wireshark.org/docs/man-pages/tshark.html
Hope this helps
Joke
On Mon, 9 Jan 2012 07:38:47 +0000 Another Sillyname wrote:
>On 9 January 2012 04:47, Martin Visser <martinvisser99@xxxxxxxxx> wrote:
>> In order to find appropriate values to monitor, it is generally much easier
>> to initially view the captured data in Wireshark. Then find the decoded
>> parameter of interest and select it. The appropriate name should should
>up
>> in the Status Bar.
>>
>> Unfortunately I can't do Wireless monitoring on my hardware, but Googling
>> and? http://wiki.wireshark.org/Wi-Fi? seems to tell me that "wlan_mgt.ssid"
>> might be what you are looking for.
>> Regards, Martin
>>
>> MartinVisser99@xxxxxxxxx
>>
>>
>> On 9 January 2012 12:34, Another Sillyname <anothersname@xxxxxxxxxxxxxx>
>> wrote:
>>>
>>> There are so many different values in tshark and I can't find the one
>>> that actually definitively tells me which channel the networks I'm
>>> watching are locked to.
>>>
>>> The only thing I can find is Tag Interpretation: Current Channel
>>>
>>> However I can't find a -e filter that matches that value.
>>>
>>> Any help appreciated.
>>>
>
>Thanks for the suggestion but I'm looking for the channel info not the ssid.
>
>Anyone?
