From 84a16cf62b38f64eaeb1ae986e886e1f83558c99 Mon Sep 17 00:00:00 2001
From: Robert McMahon <rjmcmahon@rjmcmahon.com>
Date: Fri, 13 Feb 2026 14:08:25 -0800
Subject: [PATCH] Add unique RA/TA pair counting to test_monitor_tshark.sh

Display unique RA/TA pairs with frame counts, sorted by count (descending).
This helps identify which devices are communicating with each other and
the volume of traffic between each pair.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 test_monitor_tshark.sh | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/test_monitor_tshark.sh b/test_monitor_tshark.sh
index 7eef7ea..6bd7f54 100755
--- a/test_monitor_tshark.sh
+++ b/test_monitor_tshark.sh
@@ -211,6 +211,31 @@ if [ -n "$PACKET_LINES" ] && [ "$FINAL_COUNT" -gt 0 ]; then
             $1, ra, ta, type, subtype, radiotap
     }'
     echo ""
+    
+    # Count unique RA/TA pairs
+    echo "Unique RA/TA pairs (with counts):"
+    UNIQUE_PAIRS=$(echo "$PACKET_LINES" | awk -F'\t' '{
+        ra = ($3 != "" && $3 != "-") ? $3 : "N/A"
+        ta = ($4 != "" && $4 != "-") ? $4 : "N/A"
+        if (ra != "N/A" || ta != "N/A") {
+            pair = ra " -> " ta
+            count[pair]++
+        }
+    }
+    END {
+        for (pair in count) {
+            printf "%d\t%s\n", count[pair], pair
+        }
+    }' | sort -rn)
+    
+    if [ -n "$UNIQUE_PAIRS" ]; then
+        echo "$UNIQUE_PAIRS" | awk -F'\t' '{
+            printf "  %s: %d frame(s)\n", $2, $1
+        }'
+    else
+        echo "  (no valid RA/TA pairs found)"
+    fi
+    echo ""
 else
     echo "(No packets captured)"
     echo ""