hcxdumptool and tshark

[ZerBea]

Wireshark and tshark are powerful network analyzers. It is always possible to run them in parallel to hcxdumptool/hcxlabtool on the same interface. Doing this in a second terminal you can get additional information about the traffic on the channel.

We use a CAPTURE FILTER (filter BEACONs and PROBERESPONSEs) and four customized DISPLAY FILTERs (FREQUENCY; RSSI, AKM and ESSID);
$ tshark -i INTERFACENAME -f "wlan type mgt and (subtype beacon or subtype probe-resp)" -T text -o 'gui.column.format:"FREQ",%Cus:radiotap.channel.freq,"RSSI",%Cus:radiotap.dbm_antsignal,"AKM",%Cus:wlan.rsn.akms.type,"SSID",%Cus:wlan.ssid'
The output is shown in 4 columns:
column 1 == channel
column 2 == RSSI (all antennas)
column 3 == AKM
column 4 == ESSID

Also it is possible to direct the output to a file:
$ tshark -i INTERFACENAME -f "wlan type mgt and (subtype beacon or subtype probe-resp)" -T text -o 'gui.column.format:"FREQ",%Cus:radiotap.channel.freq,"RSSI",%Cus:radiotap.dbm_antsignal,"AKM",%Cus:wlan.rsn.akms.type,"SSID",%Cus:wlan.ssid' > traffic.log

CAPTURE FILTER syntax is explained here:
$ man tshark
$ man pcap-filter
#494

DISPLAY FILTER syntax is explained here:
$ man tshark
$ tshark -G column-formats
https://www.wireshark.org/docs/dfref/

This example uses some of the build in column-formats in combination with a custom format:
$ tshark -i wlp48s0f4u2u4 -f "wlan type mgt and (subtype beacon or subtype probe-resp)" -E separator="," -T text -o 'gui.column.format:TIME,%Aut,"FREQ",%F,"RSSI",%e,"AKM",%Cus:wlan.rsn.akms.type,"SSID",%Cus:wlan.ssid'

All DISPLAY FILTERs mentioned above also work on by hcxdumptool/hcxlabtool recorded dump files:
$ tshark -r recorded_by_hcxdumptool.pcapng -Y "wlan.fc.type_subtype==0x08 || wlan.fc.type_subtype==0x05" -E separator="," -T text -o 'gui.column.format:TIME,%Aut,"FREQ",%F,"RSSI",%e,"AKM",%Cus:wlan.rsn.akms.type,"SSID",%Cus:wlan.ssid'