title: tshark unable filter mac address during live capture
body: <p>I am trying to capture packet using tshark and I want to add filter for wlan source address , so I tried below three steps but none of them worked .</p>
  
  <pre><code> ubuntu:/home/test$  tshark -i mon0 -w /tmp/test11.pcap -a duration:15 -R 
   (wlan.sa == 3e:52:82:c1:2e:a9)"
  </code></pre>
  
  <p><strong><em>tshark: -R without -2 is deprecated. For single-pass filtering use -Y.</em></strong></p>
  
  <pre><code> ubuntu:/home/test$  tshark -i mon0 -w /tmp/test11.pcap -a duration:15 -Y "
   (wlan.sa == 3e:52:82:c1:2e:a9)"
  </code></pre>
  
  <p><strong><em>tshark: Display filters aren't supported when capturing and saving the captured packets.</em></strong></p>
  
  <pre><code>ubuntu:/home/test$  tshark -i mon0 -w /tmp/test11.pcap -a duration:15 -2R "
  (wlan.sa == 3e:52:82:c1:2e:a9)"
  </code></pre>
  
  <p><strong><em>tshark: Live captures do not support two-pass analysis.</em></strong></p>
  
  <p>How to add the filter for wlan address </p>