First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

dumpcap -k is not accepting channel type values on macOS

I'm trying to perform a manual 802.11ac packet capture on a VHT80 channel.

When invoke the -k option, i'm getting not valid channel type errors:

HQSML-16882:~ Eng_Eval$ dumpcap -i en0 -k 5220,80Mhz,5220

dumpcap: "80Mhz" is not a valid 802.11 channel type

HQSML-16882:~ Eng_Eval$ dumpcap -i en0 -k 5220,VHT80,5220

dumpcap: "VHT80" is not a valid 802.11 channel type

HQSML-1688263:~ Eng_Eval$ dumpcap -i en0 -k 5220,VHT40,5220

dumpcap: "VHT40" is not a valid 802.11 channel type

HQSML-16882:~ Eng_Eval$ dumpcap -i en0 -k 5220,40MHz,5220

dumpcap: "40MHz" is not a valid 802.11 channel type

HQSML-16882:~ Eng_Eval$ dumpcap -i en0 -k 5220,40Mhz,5220

dumpcap: "40Mhz" is not a valid 802.11 channel type

HQSML-16882:~ Eng_Eval$ dumpcap -i en0 -k 5220,80MHz,5220

dumpcap: "80MHz" is not a valid 802.11 channel type

When i checked the source code, I see the function call and enumerated list for the "-k" option, but it appears the string definitions for the channel type are commented out.

https://github.com/wireshark/wireshar...

https://github.com/boundary/wireshark...

I'm running WireShark 3.2.2 on MacOS 10.14.6

Can someone provide the proper syntax for setting 5GHz channel 44 (5220 MHz) @ 80 MHz bandwidth?

cwren_wifi's avatar
1
cwren_wifi
asked 2020-04-01 17:21:47 +0000
Guy Harris's avatar
19.9k
Guy Harris
updated 2020-04-01 19:24:39 +0000
edit flag offensive 0 remove flag close merge delete

Comments

Is the dumpcap executable from Wireshark or Boundary? dumpcap -v
Wireshark current definitions here

dumpcap -i wlan0 -k 5220,VHT80,5220

is accepted as good syntax with dumpcap 3.0.5

Chuckc's avatar Chuckc (2020-04-01 18:40:25 +0000) edit
more
  • delete
add a comment see more comments

2 Answers

0

When i checked the source code, I see the function call and enumerated list for the "-k" option, but it appears the string definitions for the channel type are commented out.

Not if you look at the master branch's version of caputils/ws80211_utils.c (look at the ws80211_str_to_chan_type() function) and caputils/ws80211_utils.h (where the values that function uses are defined). That's the function set_80211_channel() in dumpcap uses.

If, however, you do look there, you see that the strings for channel type are:

  • "NOHT";
  • "HT20";
  • "HT40-;
  • "HT40+";
  • "VHT80";
  • "VHT80+80";
  • "VHT160";

"80Mhz" and "40MHz" are not, and have never been, valid values. "VHT80" is, and has been, valid since Wireshark 2.6.

However:

I'm running WireShark 3.2.2 on MacOS 10.14.6

we don't support setting the channel on macOS; it's currently Linux-only. I'll look at fixing the error message.

Guy Harris's avatar
19.9k
Guy Harris
answered 2020-04-01 18:58:10 +0000
edit flag offensive 0 remove flag delete link
more

Comments

https://www.wireshark.org/docs/man-pa...
Man page doesn't mention -k - usage or platforms supported.

Chuckc's avatar Chuckc (2020-04-01 19:01:49 +0000) edit
more
  • delete

Man page doesn't mention -k - usage or platforms supported.

Apparently the person who contributed the code didn't contribute a documentation update.

Guy Harris's avatar Guy Harris (2020-04-01 19:26:02 +0000) edit
more
  • delete

I've changed dumpcap so that it reports

dumpcap: Setting 802.11 channels is not supported on this platform

and updated the man page to mention -k and to note that it's not supported on all platforms (it doesn't mention specific platforms).

Guy Harris's avatar Guy Harris (2020-04-01 22:29:39 +0000) edit
more
  • delete

Thank you!

Chuckc's avatar Chuckc (2020-04-01 23:26:10 +0000) edit
more
  • delete

Thanks for the quick response.

cwren_wifi's avatar cwren_wifi (2020-04-02 16:28:47 +0000) edit
more
  • delete
add a comment see more comments
0

dumpcap man page with the -k options

https://www.wireshark.org/docs/wsug_h...

cwren_wifi's avatar
1
cwren_wifi
answered 2020-04-02 21:57:49 +0000
edit flag offensive 0 remove flag delete link
more

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer