After creating a wcap file with Wireless Diagnostics I used vim to inspect this file:
$ tcpdump -r 2017.98.14_17-33-49-EDT.wcap > output.txt
and then I removed all lines that had either of
(1) a MAC address.
(2) the "beacon" string.
(3) the "wep" string.
Here is a sample of what remained:
17:33:51.074520 4185535295us tsft -51dB signal -89dB noise antenna 0 5785 MHz 11a ht/40+ 65.0 Mb/s MCS 7 20 MHz (L) lon GI mixed BCC FEC [bit 20]
17:33:51.076525 4185537310us tsft short preamble 12.0 Mb/s 5785 MHz 11a -53dB signal -89dB noise antenna 0 BA RA:d4:b2:7a:39:f4:1e (oui Unknown)
17:33:51.289354 4185750140us tsft -53dB signal -87dB noise antenna 0 5785 MHz 11a ht/40+ 65.0 Mb/s MCS 7 20 MHz (L) lon GI mixed BCC FEC [bit 20]
17:33:51.611685 4186072156us tsft short preamble 6.0 Mb/s 5785 MHz 11a -79dB signal -87dB noise antenna 0 Action (a2:3a:de:12:fd:d5 (oui Unknown)): Vendor Act#0
....
- Doesn't each line in wcap represent a packet?
- If so, what type of packet is not a broadcast or does not have a MAC address?
Since I made the effort to inspect my LAN (for other reasons), I'm just curious. Not really a big deal of course.