1

I have started sudo hcitool lescan --passive --duplicate

and sudo tcpdump -i bluetooth0 -w cap.pcap

Now viewing this in Wireshark I get a lot of LE Advertising Repots

enter image description here

However in the colums I can't select MAC address and also in the statistics menu I've tried some options, but still didn't get a list of different MAC addresses present in this capture file.

enter image description here

A tshark command for getting these addresses would be great, but Wireshark is also ok.

Hannes
  • 317

1 Answers1

1

I've found the answer tshark -r cap.cap -T fields -e bthci_evt.bd_addr | sort | uniq

enter image description here

Hannes
  • 317