wlan_mgt.fixed.action_code is showing as an invalid filter on Wireshark 2.6.0

I have 2 MacBook Pros, both with 10.13.4 - one is a 13 retina from early 2015, the 2nd is a 15-inch retina machine from mid-2015

The smaller MacBook is running Wirehskar 2.6.0 The Larger MacBook is running Wireshark 2.2.0

The problem I am having is with this filter wlan_mgt.fixed.action_code == 7.

It is showing as red "invalid" on the Mac with Wireshark 2.6 and is working fine on the 2nd Mac with Wireshark 2.2

I believe I am missing something obvious, but why is the filer valid on older Wireshark and not the newer one, was it dropped? (I think unlikely) or is there something about the version of Wireshark that is preventing me to filter on management frames?

updated 2018-05-10 20:00:53 +0000

This post is a wiki. Anyone with karma >750 is welcome to improve it.

edit flag offensive 0 remove flag close merge delete

The field was renamed from 2.4.0 onward dropping the "_mgmt" part, so use wlan.fixed.action_code. See the filter reference here.

23.8k

grahamb

answered 2018-05-10 21:01:41 +0000

19.9k

Guy Harris

updated 2018-05-10 21:17:37 +0000

edit flag offensive 0 remove flag delete link

Comments

Thanks, I understand the answer, but I don't see where it says "mgmt" was dropped from wlanmgmt on this page - https://www.wireshark.org/docs/dfref/... - if search on the filter in question it doesn't tell me it was renamed

Rothiri (2018-05-10 21:31:49 +0000) edit

It doesn't say the field was renamed. It just lists the fields that can be used in packet-matching expressions such as display filters and coloring rules.

But in 2.4 and later, we don't have a separate wlan_mgmt protocol; it was incorporated into the wlan protocol, so all wlan_mgmt. fields are now just called wlan. fields.

Guy Harris (2018-05-10 21:40:14 +0000) edit

Got it, thank you

Rothiri (2018-05-10 21:58:05 +0000) edit

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

wlan_mgt.fixed.action_code is showing as an invalid filter on Wireshark 2.6.0 edit

Comments

1 Answer

Comments