diff --git a/tests/hwsim/test_cfg80211.py b/tests/hwsim/test_cfg80211.py
index 239b5105f0da..808765a78a9b 100644
--- a/tests/hwsim/test_cfg80211.py
+++ b/tests/hwsim/test_cfg80211.py
@@ -82,28 +82,9 @@ def test_cfg80211_tx_frame(dev, apdev, params):
     # note: also the Deauthenticate frame sent by the GO going down ends up
     # being transmitted incorrectly on 2422 MHz.
 
-    try:
-        arg = [ "tshark",
-                "-r", os.path.join(params['logdir'], "hwsim0.pcapng"),
-                "-Y", "wlan.fc.type_subtype == 13",
-                "-Tfields", "-e", "radiotap.channel.freq" ]
-        cmd = subprocess.Popen(arg, stdout=subprocess.PIPE,
-                               stderr=open('/dev/null', 'w'))
-    except Exception, e:
-        logger.info("Could run run tshark check: " + str(e))
-        cmd = None
-        pass
-
-    if cmd:
-        (out,err) = cmd.communicate()
-        res = cmd.wait()
-        if res == 1:
-            arg[3] = '-R'
-            cmd = subprocess.Popen(arg, stdout=subprocess.PIPE,
-                                   stderr=open('/dev/null', 'w'))
-            (out,err) = cmd.communicate()
-            res = cmd.wait()
-
+    out = run_tshark(os.path.join(params['logdir'], "hwsim0.pcapng"),
+                     "wlan.fc.type_subtype == 13", ["radiotap.channel.freq"])
+    if out is not None:
         freq = out.splitlines()
         if len(freq) != 2:
             raise Exception("Unexpected number of Action frames (%d)" % len(freq))
diff --git a/tests/hwsim/test_p2p_channel.py b/tests/hwsim/test_p2p_channel.py
index 19cad6ea900f..d45604bbbea2 100644
--- a/tests/hwsim/test_p2p_channel.py
+++ b/tests/hwsim/test_p2p_channel.py
@@ -12,6 +12,7 @@ import time
 
 import hostapd
 import hwsim_utils
+from tshark import run_tshark
 from wpasupplicant import WpaSupplicant
 from hwsim import HWSimRadio
 from test_p2p_grpform import go_neg_pin_authorized
@@ -131,28 +132,9 @@ def test_p2p_channel_random_social_with_op_class_change(dev, apdev, params):
             raise Exception("Unexpected channel %d MHz - did not pick random social channel" % freq)
         remove_group(dev[0], dev[1])
 
-        try:
-            arg = [ "tshark",
-                    "-r", os.path.join(params['logdir'], "hwsim0.pcapng"),
-                    "-Y", "wifi_p2p.public_action.subtype == 0",
-                    "-V" ]
-            cmd = subprocess.Popen(arg, stdout=subprocess.PIPE,
-                                   stderr=open('/dev/null', 'w'))
-        except Exception, e:
-            logger.info("Could run run tshark check: " + str(e))
-            cmd = None
-            pass
-
-        if cmd:
-            (out,err) = cmd.communicate()
-            res = cmd.wait()
-            if res == 1:
-                arg[3] = '-R'
-                cmd = subprocess.Popen(arg, stdout=subprocess.PIPE,
-                                       stderr=open('/dev/null', 'w'))
-                (out,err) = cmd.communicate()
-                res = cmd.wait()
-
+        out = run_tshark(os.path.join(params['logdir'], "hwsim0.pcapng"),
+                         "wifi_p2p.public_action.subtype == 0")
+        if out is not None:
             last = None
             for l in out.splitlines():
                 if "Operating Channel:" not in l:
diff --git a/tests/hwsim/test_scan.py b/tests/hwsim/test_scan.py
index 96d25267b798..55931081f699 100644
--- a/tests/hwsim/test_scan.py
+++ b/tests/hwsim/test_scan.py
@@ -13,6 +13,7 @@ import subprocess
 import hostapd
 from wpasupplicant import WpaSupplicant
 from utils import HwsimSkip
+from tshark import run_tshark
 
 def check_scan(dev, params, other_started=False, test_busy=False):
     if not other_started:
@@ -707,32 +708,10 @@ def _test_scan_random_mac(dev, apdev, params):
     for args in tests:
         dev[0].request("MAC_RAND_SCAN " + args)
         dev[0].scan_for_bss(bssid, freq=2412, force_scan=True)
-    # wait a bit to make it more likely for wlantest sniffer to have captured
-    # and written the results into a file that we can process here
-    time.sleep(1)
-
-    try:
-        arg = [ "tshark",
-                "-r", os.path.join(params['logdir'], "hwsim0.pcapng"),
-                "-Y", "wlan.fc.type_subtype == 4",
-                "-Tfields", "-e", "wlan.ta" ]
-        cmd = subprocess.Popen(arg, stdout=subprocess.PIPE,
-                               stderr=open('/dev/null', 'w'))
-    except Exception, e:
-        logger.info("Could run run tshark check: " + str(e))
-        cmd = None
-        pass
-
-    if cmd:
-        (out,err) = cmd.communicate()
-        res = cmd.wait()
-        if res == 1:
-            arg[3] = '-R'
-            cmd = subprocess.Popen(arg, stdout=subprocess.PIPE,
-                                   stderr=open('/dev/null', 'w'))
-            (out,err) = cmd.communicate()
-            res = cmd.wait()
 
+    out = run_tshark(os.path.join(params['logdir'], "hwsim0.pcapng"),
+                     "wlan.fc.type_subtype == 4", ["wlan.ta" ])
+    if out is not None:
         addr = out.splitlines()
         logger.info("Probe Request frames seen from: " + str(addr))
         if dev[0].own_addr() in addr:
diff --git a/tests/hwsim/tshark.py b/tests/hwsim/tshark.py
new file mode 100644
index 000000000000..55e06175b448
--- /dev/null
+++ b/tests/hwsim/tshark.py
@@ -0,0 +1,52 @@
+#
+# tshark module - refactored from test_scan.py
+#
+# Copyright (c) 2014, Qualcomm Atheros, Inc.
+# Copyright (c) 2015, Intel Mobile Communications GmbH
+#
+# This software may be distributed under the terms of the BSD license.
+# See README for more details.
+
+import time
+import subprocess
+import logging
+logger = logging.getLogger()
+
+
+_tshark_filter_arg = '-Y'
+
+def run_tshark(filename, filter, display=None):
+    # wait a bit to make it more likely for wlantest sniffer to have captured
+    # and written the results into a file that we can process here
+    time.sleep(1)
+
+    try:
+        arg = [ "tshark", "-r", filename,
+                _tshark_filter_arg, "wlan.fc.type_subtype == 4",
+                "-Tfields", ]
+        if display:
+            arg.append('-Tfields')
+            for d in display:
+                arg.append('-e')
+                arg.append(d)
+        else:
+            arg.append('-V')
+        cmd = subprocess.Popen(arg, stdout=subprocess.PIPE,
+                               stderr=open('/dev/null', 'w'))
+    except Exception, e:
+        logger.info("Could run run tshark check: " + str(e))
+        cmd = None
+        return None
+
+    out = cmd.communicate()[0]
+    res = cmd.wait()
+    if res == 1:
+        # remember this for efficiency
+        _tshark_filter_arg = '-R'
+        arg[3] = '-R'
+        cmd = subprocess.Popen(arg, stdout=subprocess.PIPE,
+                               stderr=open('/dev/null', 'w'))
+        out = cmd.communicate()[0]
+        cmd.wait()
+
+    return out
