Enable Status about hcxdumptool HOT 4 CLOSED

Very interesting, because there is no entry inside the man page and the man page refers to help.
https://github.com/ZerBea/hcxdumptool/blob/master/man/hcxdumptool.1
Arch Linux does not install this man page:
https://archlinux.org/packages/extra/x86_64/hcxdumptool/files/

Since v6.3.0 nearly everything changed in favor of speed. The code is highly optimized and everything that makes it slow has been removed. This is explained in the changelog:

06.04.2023
==========
release v6.2.9
several bug fixes

This is the last version:
that use WIRELESS EXTENSIONS
that use ETHTOOL to get/set virtual MAC address
that use old style status output
that use soft coded filter lists
that use msec timestamp
that use crypto stuff
that use server/client mode to display status

Next version will go back to the roots:
set focus on WPA PSK (WPA1, WPA2, WPA2 key version 3)
set bandwidth to 20MHz to increase range
set bitrate to lowest values to increase range
use active monitor mode
use NL80211 stack
use RTNETLINK
band a, b, c, d, e support
use NMEA messages:
 $GPRMC: Position, velocity, time and date
 $GPGGA: Position, orthometric height, fix related data, time
 $GPWPL: Position and MAC AP
 $GPTXT: ESSID in HEX ASCII
remove options that slow hcxdumptool down

There is also a discussion about the new style:
#343

From no on, hcxdumptool is able to run completely headless, e.g. on a penetration testing system like this one:
https://github.com/ZerBea/hcxdumptool/wiki/Penetration-testing-system-2
The status display can be compiled completely out. Remove -DSTATUSOUT from Makefile.
The same applies to GPS support. If you don't need it remove -DNMEAOUT from Makefile.

That means you now have two choices:
If you don't need a status display (headless system) - compile it out and hcxdumptool is really fast
If you really need a status display there is no longer need to enable it - just change its sorting by --rds

from hcxdumptool.

Please notice:
If you need/like an expanded waterfall realtime display, hcxdumptool is designed to run in parallel with tshark and/or Wireshark.
You can do this either on hcxdumptool's monitor interface (real time) or on the hcxdumptool's pcapng dump file while hcxdumptool is running.

Example:
view all already captured PMKIDs while hcxdumptool is running:
run hcxdumptool in terminal 1:
$ sudo hcxdumptool -i interface -w test.pcapng
run tshark in terminal 2:
tshark -r test.pcapng -Y "wlan.rsn.ie.pmkid" -T fields -e wlan.ra -e wlan.ta -e wlan.rsn.ie.pmkid | sort | uniq

More information is here:
https://tshark.dev/analyze/packet_hunting/packet_hunting/

from hcxdumptool.

workflow:
Do not create interface by third party tools!
Do not use a virtual monitor interface (wlanXmon)!

hcxdumptool and tshark/Wireshark running on the same dump file:
terminal1: hcxdumptool & BPF dump file pcapng -> terminal2: tshark -r dump file & display filter

hcxdumptool and tshark/Wireshark running on the same interface:
terminal1: hcxdumptool & BPF -> terminal2: tshark -i & -w & capture filter

entire tshark wlan filter reference:
https://www.wireshark.org/docs/dfref/w/wlan.html

from hcxdumptool.

Closed, because it is not an issue, but more a discussion.

from hcxdumptool.