From 189444c88f77089d253cdf32fa37abf18e8a6d55 Mon Sep 17 00:00:00 2001 From: Robert McMahon Date: Fri, 13 Feb 2026 14:04:11 -0800 Subject: [PATCH] Add display filter to capture only frames with RA/TA Use tshark display filter to only capture frames that have RA or TA fields. This prevents tshark from erroring when encountering management frames that don't have these fields, which was causing early termination of captures. Co-authored-by: Cursor --- test_monitor_tshark.sh | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/test_monitor_tshark.sh b/test_monitor_tshark.sh index 522f7ce..ad4dd52 100755 --- a/test_monitor_tshark.sh +++ b/test_monitor_tshark.sh @@ -136,8 +136,12 @@ echo "Capturing packets for $DURATION seconds..." # Also, wlan.ra/wlan.ta may not be available for all frame types, which can cause tshark to exit with code 1 # We'll capture both stdout and stderr, but continue even if tshark exits with an error set +e # Temporarily disable exit on error -# Use -q to suppress packet count output, and continue even if some fields are missing -CAPTURE_OUTPUT=$(timeout "$DURATION" tshark -q -i "$INTERFACE" -n -T fields \ +# Use -q to suppress packet count output +# Use display filter to only capture frames that have RA/TA fields +# This prevents tshark from erroring when it encounters frames without these fields +CAPTURE_OUTPUT=$(timeout "$DURATION" tshark -q -i "$INTERFACE" -n \ + -Y "(wlan.ra) || (wlan.ta)" \ + -T fields \ -e frame.number \ -e frame.time \ -e wlan.ra \