Wireshark-dev: [Wireshark-dev] tshark and IEEE 802.11 Aggregated MPDU

From: Vincent Magnin <Vincent.Magnin@xxxxxxx>
Date: Mon, 30 Jun 2008 15:32:01 +0200
Hi All,

I am a user of Wireshark 1.0 and I use the AirPcap N card for my Wifi analysis.

I've problems with IEEE 802.11n aggregated A-MPDU data (using fields mode):

- How can I have access, with tshark, to a specific A-MPDU?

tshark -T fields -e frame.number -e wlan.sa -e wlan.da -e wlan.fcs_good -r sample.pcap

Packet 15 shows data of only 1 A-MPDU.

Is it possible to do things like:

tshark -T fields -e frame.number -e wlan_aggregate[n].wlan.sa -e wlan_aggregate[n].wlan.da -e wlan_aggregate[n].wlan.fcs_good -r sample.pcap

Where n in wlan_aggregate[n] is the MPDU number.


Regards,


Vincent Magnin

Attachment: sample.pcap
Description: application/cap