ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: [Wireshark-users] tshark, wlan.flags consistency & format

From: Anthony Murabito <anthony@xxxxxxxxxxx>
Date: Thu, 25 Mar 2010 13:31:41 -0400
Hi All,

I am currently making some changes to some automation software that uses tshark's output. My development has been primarily in a linux environment and is tied to wireless lans. I have noticed that tsharks default output is different between a windows & linux machine, and essentially I am hoping to get the nice "Flags" bitmap that appears in linux, to appear in windows.

For example, currently I am using

tshark -r (filename) -z proto,colinfo,frame.len,frame.len -z proto,colinfo,wlan.bssid,wlan.bssid

here is the corresponding tshark output:

(linux)
34659 372.477882 OUI_05:02:a9 ->
OUI_34:cb:0e IEEE 802.11 Data, SN=285, FN=0, Flags=.p.....TC  wlan.bssid == 00:00:00:79:37:70  frame.len == 408

(windows)
34659 372.477882 OUI_05:02:a9 -> OUI_34:cb:0e IEEE 802.11 Data,SN=285,FN=0  wlan.bssid == 00:15:70:79:37:70  frame.len == 408


I have emboldened the flags section I am referring to, which is present under linux's tshark output, but not under window's tshark output.

I've been using the -z options to extract and append various other values (such as bssid, and frame length) to tshark's default output, however doing this to wlan.flags yields a hex value. This is not the end of the world, as I can bitmask the values out that I want, however tshark also includes a C flag (this is not part of wlan.flags) to tell you if the frame has a valid CRC.

If anyone knows how to get the windows version of tshark to display the flags in the format the linux does (that nice bitmap + CRC bit) please let me know. The man page doesn't seem to go into the level of detail I want here, but I'll keep reading and researching in the meantime to attempt to figure this out.

Thanks!
--
Anthony