Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

I think you've stumbled upon Bug 8859 - Apply consistent naming convention to checksum display filter fields and expert info..

I think the basic problem you're experiencing is due to fields that are only part of the Expert category. These fields are either present or absent and don't contain a value per se. So while you can test for the existence of Expert Info fields such as wlan.fcs.bad_checksum, you can't test for it having a particular value, i.e., wlan.fcs.bad_checksum == 1. The bigger problem here is, "How is the user supposed to know which fields are Expert only fields where you can only test for presence/absence, and which fields are normal fields where you can perform comparisons against specific values?". Of course one can always check the source code of packet-ieee80211.c, but that's not the most user-friendly method. The online display filter reference page does list these types of fields as a Label, so that is a clue, but I don't think that's entirely obvious to users either. Perhaps as a part of the resolution to Bug 8859, improvements could be made in this area too, although the issue isn't restricted to checksum-related fields but rather to all expert fields, so perhaps a new bug should be filed with the problem being that it's unclear how to use "Expert" fields vs so-called "Normal" fields.

So, to summarize:

FIELD                    TYPE      TEST                EXAMPLE
wlan.fcs                 Normal    Comparison          wlan.fcs == 0xa2619a02
wlan.fcs.status          Normal    Comparison          wlan.fcs.status == "Bad"
wlan.fcs.bad_checksum    Expert    Presence/Absence    wlan.fcs.bad_checksum
radiotap.flags.badfcs    Normal    Comparison          radiotap.flags.badfcs == 1

NOTE: "Normal" fields can also be tested for presence/absence too.

Lastly, you mentioned, "Why wlan.fcs.status == 1 works in GUI but not in Lua (without errors)". Does it? It doesn't work in the GUI for me. I mean, it's accepted as a valid filter, but it doesn't really achieve the desired result. Instead, you need wlan.fcs.status == "Bad" for that.