Help troubleshooting a BPF

[ButtBundy]

hcxdumptool 6.3.5-3-g3725338 (C) 2024 ZeroBeat
running on Linux kernel 6.11.2-amd64
running GNU libc version 2.40
compiled by gcc 14.2.0
compiled with Linux API headers 6.11.2
compiled with GNU libc headers 2.40
enabled REALTIME DISPLAY
enabled GPS support
enabled BPF compiler

hcxdumptool --bpfc="wlan addr1 00c0cab035be or wlan addr2 00c0cab035be or wlan addr3 00c0cab035be" >> attack.bpf is working great. I don't see any other AP's or clients

excluding seems to be harder....

i tried

hcxdumptool --bpfc="not wlan addr1 00c0cab035be" >> protect.bpf
hcxdumptool --bpfc="not wlan addr2 00c0cab035be" >> protect.bpf
hcxdumptool --bpfc="not wlan addr3 00c0cab035be" >> protect.bpf

but it keeps showing

[ZerBea]

That is an incorrect use of a BPF, because you can't cat or pipe filters.
Correct use is:
$ hcxdumptool --bpfc=" all your filter instruction inside here" > filter.bpf

It is mandatory to use BOLEAN operators (and, or, not) and brackets to combine them inside a single line, e.g.:
exclude single network (00c0cab035be):
$ hcxdumptool --bpfc="not wlan addr3 00c0cab035be" > filter.bpf

exclude two networks (00c0cab035be, 00c0cab035bc):
$ hcxdumptool --bpfc="not wlan addr3 00c0cab035be and not wlan addr3 00c0cab035bc" > filter.bpf

More information is here:
#485
and of course here:
$ man pcap-filter

Moved to discussion, because it is not an issue

[ButtBundy]

works like a charm! tnx again for your super fast reply!

[ZerBea]

I know, BPF coding is hard core, but makes sense to learn it.
A BPF is running in kernel space. That makes it really fast.
A BPF is flexible. Nearly everything can be filtered.
This is much, much better than a command line option like "--bssid=11:22:33:44:55:66".

You can build filter code for every purpose and store them to a directory.
Now you can run always the same command line:
$ hcxdumptool --bpf="$HOME/bpf/attackfilter1.bpf" -.... same options
$ hcxdumptool --bpf="$HOME/bpf/protectfilter.bpf" -.... same options
$ hcxdumptool --bpf="$HOME/bpf/myfavoritefilter.bpf" -.... same options
...