rjmcmahon
/
fiwi_monitor
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix tshark field names for RA/TA display 

Replace invalid wlan.addr1/wlan.addr2 with wlan.ra/wlan.ta fields.
These fields are the correct tshark field names for Receiver Address
and Transmitter Address in monitor mode captures.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Robert McMahon 2026-02-13 14:01:36 -08:00
parent 1e9191f6c7
commit 744bc35597
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
test_monitor_tshark.sh
View File

@ -84,11 +84,12 @@ echo "(This may take up to 2 seconds if no packets are present)"
# Use timeout with -c to limit packets and avoid hanging
# Capture both stdout and stderr
# Fields: frame.number, wlan.addr1 (RA/Receiver Address), wlan.addr2 (TA/Transmitter Address), radiotap.present
# Fields: frame.number, wlan.ra (Receiver Address), wlan.ta (Transmitter Address), radiotap.present
# Note: wlan.ra and wlan.ta may not be available for all frame types, but are correct for monitor mode
TEST_OUTPUT=$(timeout 2 tshark -i "$INTERFACE" -c 100 -T fields \
-e frame.number \
-e wlan.addr1 \
-e wlan.addr2 \
-e wlan.ra \
-e wlan.ta \
-e radiotap.present \
2>&1 || true)
TEST_EXIT_CODE=${PIPESTATUS[0]}
@ -136,8 +137,8 @@ set +e # Temporarily disable exit on error
CAPTURE_OUTPUT=$(timeout "$DURATION" tshark -i "$INTERFACE" -n -T fields \
-e frame.number \
-e frame.time \
-e wlan.addr1 \
-e wlan.addr2 \
-e wlan.ra \
-e wlan.ta \
-e wlan.fc.type \
-e wlan.fc.subtype \
-e wlan.fc.type_subtype \