Describe the bug
Tshark does not decode the Bluetooth layer (useful for source & dest MAC address) by default.
You have to pass the flag "-2" to enable two-pass decoding (see more at https://gitlab.com/wireshark/wireshark/-/issues/17236).
If you pass the parameter using custom_parameters={"": "-2"} it invalidly crashes with a misleading error message ("Live captures do not support two-pass analysis"), even though FileCapture is used.
If you pass parameters that are empty or space, it also crashes with 0 packets decoded.
If i turn debug mode and manually run the command pyshark is executing, it works fine:
2026-01-03 00:14:23,115 - FileCapture - DEBUG - Creating TShark subprocess with parameters: /usr/bin/tshark -l -n -T pdml -Y btatt.opcode == 0x0A || btatt.opcode == 0x12 || btatt.opcode == 0x0C || btatt.opcode == 0x1B -2 -r /tmp/test.pcap
After looking around, I could find the commit 8bb1185 which adds a possible workaround:
custom_parameters=["-2"] .
To Reproduce
See the custom_parameters commands above.
Expected behavior
Clear indication of the real reason behind the crash, at least documentation update.
Versions (please complete the following information):
- OS: Linux Debian
- pyshark version: 0.6
- tshark version: 4.6.2
Example pcap / packet
I am unable to share it sadly.
Describe the bug
Tshark does not decode the Bluetooth layer (useful for source & dest MAC address) by default.
You have to pass the flag "-2" to enable two-pass decoding (see more at https://gitlab.com/wireshark/wireshark/-/issues/17236).
If you pass the parameter using custom_parameters={"": "-2"} it invalidly crashes with a misleading error message ("Live captures do not support two-pass analysis"), even though FileCapture is used.
If you pass parameters that are empty or space, it also crashes with 0 packets decoded.
If i turn debug mode and manually run the command pyshark is executing, it works fine:
2026-01-03 00:14:23,115 - FileCapture - DEBUG - Creating TShark subprocess with parameters: /usr/bin/tshark -l -n -T pdml -Y btatt.opcode == 0x0A || btatt.opcode == 0x12 || btatt.opcode == 0x0C || btatt.opcode == 0x1B -2 -r /tmp/test.pcap
After looking around, I could find the commit 8bb1185 which adds a possible workaround:
custom_parameters=["-2"] .
To Reproduce
See the custom_parameters commands above.
Expected behavior
Clear indication of the real reason behind the crash, at least documentation update.
Versions (please complete the following information):
Example pcap / packet
I am unable to share it sadly.