MacOS 13.4.1
I'm trying to capture 802.11 management packets with a real 802.11 headers (not just Ethernet header) with tshark. So trying to use
% sudo tshark -i wifi0 -I -L
Data link types of interface wifi0 when in monitor mode (use option -y to set):
IEEE802_11_RADIO (802.11 plus radiotap header)
Then trying to use as suggested
% sudo tshark -i wifi0 -I -y IEEE802_11_RADIO
Capturing on 'Wi-Fi: wifi0'
** (tshark:32984) 20:15:55.258837 [Main MESSAGE] -- Capture started.
** (tshark:32984) 20:15:55.259162 [Main MESSAGE] -- File: "/var/tmp/wireshark_Wi-FiN4FL81.pcapng"
^Ctshark:
0 packets captured
So after waiting for a few time and then interrupting with CTRL+C I got 0 packets captured, but with a regular capturing from the interface wifi0 it reports a lot of packets with Ethernet headers.
Why can't a monitor mode with -I capture any packets? Is there a solution for that?
