wlan_mgt.fixed.action_code is showing as an invalid filter on Wireshark 2.6.0

asked 2018-05-10 20:00:53 +0000

This post is a wiki. Anyone with karma >750 is welcome to improve it.

I have 2 MacBook Pros, both with 10.13.4 - one is a 13 retina from early 2015, the 2nd is a 15-inch retina machine from mid-2015

The smaller MacBook is running Wirehskar 2.6.0 The Larger MacBook is running Wireshark 2.2.0

The problem I am having is with this filter wlan_mgt.fixed.action_code == 7.

It is showing as red "invalid" on the Mac with Wireshark 2.6 and is working fine on the 2nd Mac with Wireshark 2.2

I believe I am missing something obvious, but why is the filer valid on older Wireshark and not the newer one, was it dropped? (I think unlikely) or is there something about the version of Wireshark that is preventing me to filter on management frames?

answered 2018-05-10 21:01:41 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23835 ●4 ●973 ●227 https://www.wireshark.org

updated 2018-05-10 21:17:37 +0000

Guy Harris
19890 ●3 ●659 ●207

The field was renamed from 2.4.0 onward dropping the "_mgmt" part, so use wlan.fixed.action_code. See the filter reference here.

edit flag offensive delete link

Comments

Thanks, I understand the answer, but I don't see where it says "mgmt" was dropped from wlanmgmt on this page - https://www.wireshark.org/docs/dfref/... - if search on the filter in question it doesn't tell me it was renamed

Rothiri ( 2018-05-10 21:31:49 +0000 )edit

It doesn't say the field was renamed. It just lists the fields that can be used in packet-matching expressions such as display filters and coloring rules.

But in 2.4 and later, we don't have a separate wlan_mgmt protocol; it was incorporated into the wlan protocol, so all wlan_mgmt. fields are now just called wlan. fields.

Guy Harris ( 2018-05-10 21:40:14 +0000 )edit

Got it, thank you

Rothiri ( 2018-05-10 21:58:05 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

wlan_mgt.fixed.action_code is showing as an invalid filter on Wireshark 2.6.0

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

wlan_mgt.fixed.action_code is showing as an invalid filter on Wireshark 2.6.0 edit

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

wlan_mgt.fixed.action_code is showing as an invalid filter on Wireshark 2.6.0