 | 1 | initial version |
I think you've stumbled upon Bug 8859 - Apply consistent naming convention to checksum display filter fields and expert info..
I think the basic problem you're experiencing is due to fields that are only part of the Expert category. These fields are either present or absent and don't contain a value per se. So while you can test for the existence of Expert Info fields such as wlan.fcs.bad_checksum, you can't test for it having a particular value, i.e., wlan.fcs.bad_checksum == 1. The bigger problem here is, "How is the user supposed to know which fields are Expert only fields where you can only test for presence/absence, and which fields are normal fields where you can perform comparisons against specific values?". Of course one can always check the source code of packet-ieee80211.c, but that's not the most user-friendly method. The online display filter reference page does list these types of fields as a Label, so that is a clue, but I don't think that's entirely obvious to users either. Perhaps as a part of the resolution to Bug 8859, improvements could be made in this area too, although the issue isn't restricted to checksum-related fields but rather to all expert fields, so perhaps a new bug should be filed with the problem being that it's unclear how to use "Expert" fields vs so-called "Normal" fields.
So, to summarize:
FIELD TYPE TEST EXAMPLE wlan.fcs Normal Comparison wlan.fcs == 0xa2619a02 wlan.fcs.status Normal Comparison wlan.fcs.status == "Bad" wlan.fcs.bad_checksum Expert Presence/Absence wlan.fcs.bad_checksum radiotap.flags.badfcs Normal Comparison radiotap.flags.badfcs == 1
NOTE: "Normal" fields can also be tested for presence/absence too.
Lastly, you mentioned, "Why wlan.fcs.status == 1 works in GUI but not in Lua (without errors)". Does it? It doesn't work in the GUI for me. I mean, it's accepted as a valid filter, but it doesn't really achieve the desired result. Instead, you need wlan.fcs.status == "Bad" for that.
