Wireshark · Wireshark-dev: [Wireshark-dev] tshark and IEEE 802.11 Aggregated MPDU

[Vincent Magnin <Vincent.Magnin@xxxxxxx>]

Hi All,

I am a user of Wireshark 1.0 and I use the AirPcap N card for my Wifi  
analysis.

I've problems with IEEE 802.11n aggregated A-MPDU data (using fields mode):

- How can I have access, with tshark, to a specific A-MPDU?

> tshark -T fields -e frame.number -e wlan.sa -e wlan.da -e  
> wlan.fcs_good -r sample.pcap

Packet 15 shows data of only 1 A-MPDU.

Is it possible to do things like:

> tshark -T fields -e frame.number -e wlan_aggregate[n].wlan.sa -e  
> wlan_aggregate[n].wlan.da -e wlan_aggregate[n].wlan.fcs_good -r  
> sample.pcap

Where n in wlan_aggregate[n] is the MPDU number.


Regards,


Vincent Magnin

Attachment: sample.pcap
Description: application/cap