I get an invalid capture filter when trying to use this:

tshark -i mon0 subtype probe-req -T fields -e wlan.sa -e wlan_mgt.ssid

I am trying to limit my results to just the source address and SSID of the request. It runs fine without the field options...Thanks!

  • 1
    I have found a lot of information regarding capturing SSID's but they all filter by MAC address instead of Source IP. Could you please clarify exactly what your goal is? Is it necessary to only use tshark or can the reports created from the graphical client be used? Are you trying to filter what you are trying to capture or simply filter the results to generate a report? Filtering what you capture may not work to be able to collect SSID's however it would be pretty straight forward to filter your results into a text file with only the desired information.
    – kemotep
    Jun 6, 2018 at 13:25
  • Im running on terminal only system but thanks anyways
    – axxic3
    Jun 7, 2018 at 6:16

1 Answer 1


I assume you have to put your capture filter in quotation marks, preceded with -f like that:

tshark -i mon0 -f "subtype probe-req" -T fields -e wlan.sa -e wlan_mgt.ssid

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .