1

What tshark command could start listening to a specific network and see who (MAC-wise) is connecting to it?

I already have the network card in monitor mode at the correct channel. WireShark can already perform this task, but I'd prefer something without a GUI.

jenold conele
  • 11
  • 2

1 Answers1

2

This command will show you the IP address and the corresponding MAC address for traffic coming in/out on the wlan0 interface:

$ tshark -i wlan0 -nn -e ip.dst -e eth.dst -Tfields -E separator=, -R ip
198.252.206.16,00:a0:cc:79:36:b3
198.252.206.16,00:a0:cc:79:36:b3
72.21.91.121,00:a0:cc:79:36:b3
198.252.206.25,00:a0:cc:79:36:b3
198.252.206.25,00:a0:cc:79:36:b3
198.252.206.25,00:a0:cc:79:36:b3
198.252.206.25,00:a0:cc:79:36:b3
198.252.206.16,00:a0:cc:79:36:b3

References

slm
  • 363,520
  • 117
  • 767
  • 871