openwrt18.06(monitor) :
tcpdump -i wlan0 "ether[0xa:4]==0x13223344"
You can capture the packets after filtering the mac address.it work well.
openwrt19.06/21.03(monitor)
tcpdump -i wlan0 "ether[0xa:4]==0x13223344"
Unable to capture packets after adding mac filter.It work bad.
But when I do not fill in the mac address filter, save all the captured data to a file, and then filter the file, I can capture the data packets
tcpdump -i wlan0 -w /tmp/test.pcap
tcpdump -r //tmp/test.pcap "ether[0xa:4]==0x13223344"
Filtering from a file it seems to work fine.
what could be causing this ?
I'm encountering exactly the same issue at the moment, capture filters working fine on pre 19 but not after. I'm on Atheros QCA9533 ath9k, how about you @zhangsd20 ?
The capture filter works on the wired interface, but not on wireless (on the same system). So I'd guess this is a wlan driver issue? Also BPF filters in my own code are not working on the wlan interface on this machine.
We might be hitting this: Mac80211 bpf monitor hooks, but how did it work before?
EDIT: So it's not that bpf is not implemented yet, but I was hitting this bug:
https://github.com/openwrt/openwrt/issues/7044
Apparently BPF JIT breaks bpf filtering on 802.11 monitor mode traffic. Luckily there is an easy workaround by disabling bpf jit:
echo 0 > /proc/sys/net/core/bpf_jit_enable