I've 2 wireless interfaces one has the type of AP and the other has the type monitor.
the AP is attached to a bridge br-lan.
When I run for example:
tcpdump port 5201 -s 0 -ni wlan0
TCPdump is not able to capture any traffic, while if I run it without the "port 5201" filter it captures everything. The same situation if I filter only on "udp", it was not able to capture any single packet.
and when I run it on the br-lan interface using the exact filter:
tcpdump port 5201 -s 0 -ni br-lan
it works perfectly as I want, but the problem I'm not able to get the radiotap header in this case since it considers the bridge as Ethernet interface.
What's the solution in this case ? Is there any format to specify to filter in link type : IEEE802_11_Radio ?? Is there any specific tool to do that with wireless adapters?
Thanks in advance.
What caused this issue is the WDS (Wireless Distributed System) enabled on the station device (My scenario is: two devices with openwrt in infrastructure mode). As soon as I reconfigured my station device not to use WDS, tcpdump worked correctly as I wanted. Still the real explanation why this happened is unknown.
if someone knows the reason or knows how to filter the traffic in WDS mode, please mention it in the answers since I've lost a feature because of disabling WDS.