Ask Your Question
0

wlan_mgt.fixed.action_code is showing as an invalid filter on Wireshark 2.6.0

asked 2018-05-10 20:00:53 +0000

this post is marked as community wiki

This post is a wiki. Anyone with karma >750 is welcome to improve it.

I have 2 MacBook Pros, both with 10.13.4 - one is a 13 retina from early 2015, the 2nd is a 15-inch retina machine from mid-2015

The smaller MacBook is running Wirehskar 2.6.0 The Larger MacBook is running Wireshark 2.2.0

The problem I am having is with this filter wlan_mgt.fixed.action_code == 7.

It is showing as red "invalid" on the Mac with Wireshark 2.6 and is working fine on the 2nd Mac with Wireshark 2.2

I believe I am missing something obvious, but why is the filer valid on older Wireshark and not the newer one, was it dropped? (I think unlikely) or is there something about the version of Wireshark that is preventing me to filter on management frames?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
1

answered 2018-05-10 21:01:41 +0000

grahamb gravatar image

updated 2018-05-10 21:17:37 +0000

Guy Harris gravatar image

The field was renamed from 2.4.0 onward dropping the "_mgmt" part, so use wlan.fixed.action_code. See the filter reference here.

edit flag offensive delete link more

Comments

Thanks, I understand the answer, but I don't see where it says "mgmt" was dropped from wlanmgmt on this page - https://www.wireshark.org/docs/dfref/... - if search on the filter in question it doesn't tell me it was renamed

Rothiri gravatar imageRothiri ( 2018-05-10 21:31:49 +0000 )edit

It doesn't say the field was renamed. It just lists the fields that can be used in packet-matching expressions such as display filters and coloring rules.

But in 2.4 and later, we don't have a separate wlan_mgmt protocol; it was incorporated into the wlan protocol, so all wlan_mgmt. fields are now just called wlan. fields.

Guy Harris gravatar imageGuy Harris ( 2018-05-10 21:40:14 +0000 )edit

Got it, thank you

Rothiri gravatar imageRothiri ( 2018-05-10 21:58:05 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2018-05-10 20:00:53 +0000

Seen: 49 times

Last updated: May 10