Tcpdump will not filter correctly (looks like libpcap issue)

Installing and Using OpenWrt Network and Wireless Configuration
1

Hello.
I am running the latest trunk (as of yesterday, at least).

I need to filter packets by src mac.
Some filters do work, for example: I managed to see management frames but cannot filter by mac address:
tcpdump -e -ns1500 -i wlan0 type mgt -vv shows this:

12:17:31.017071 864258784us tsft 6.0 Mb/s 5180 MHz 11a -76dBm signal -76dBm signal antenna 0 0us BSSID:AA:BB:CC:DD:EE:FF DA:ff:ff:ff:ff:ff:ff SA:FF:EE:AA:BB:CC:DD Beacon (WiFi-Network) [6.0* 9.0 12.0* 18.0 24.0* 36.0 48.0 54.0 Mbit] ESS CH: 36, PRIVACY

etc, etc...
Trying to filter by source host yields nothing:
tcpdump -e -ns1500 -i wlan0 ether src AA:BB:CC:DD:EE:FF or:
tcpdump -e -ns1500 -i wlan0 ether src FF:EE:AA:BB:CC:DD

Even filtering any host with this mac shows nothing:
tcpdump -e -ns1500 -i wlan0 ether host AA:BB:CC:DD:EE:FF or:
tcpdump -e -ns1500 -i wlan0 ether host FF:EE:AA:BB:CC:DD

I used tcpdump-mini but tested with the full version as well.

tcpdump -h gives:
tcpdump version 4.9.3
libpcap version 1.9.1 (with TPACKET_V3)

This is a regression for me, moving from OpenWRT 15 & 10.
Any idea what's wrong here? Thanks.

2

On my spapshot with the same tcpdump and libpcap versions both work.
Same on another device with 19.07.1 and the same tcpdump and libpcap versions.

3

Interesting, thanks.
I'd like to focus the issue then, I tested the same filter on wired ethernet and it indeed works fine, the filter does not work on wifi, have you tried this in wifi? (monitor mode)
Just to be safe, I also tried:
tcpdump -ns 1500 -i wlan0 -vv -e wlan addr[1-4] ...
(to no avail)

4

On the second device I tried it on the wlan0 interface (sta mode).

5

Thanks.
I wonder what could that be then :confused: