This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Granularity missing in latest wireshark for WMM parameters?

In wireshark 1.2 version, we had display filters such as

wlan_mgt.wme.be.ac_param.ecwmin==7, i.e. you could filter packets based on WMM parameters for a specific access category.

But in latest wireshark, we can't do that. i.e. , if I want packets which has ECWMIN for Best Effort is equal to 7, I can't do that. What I can do is, packets maching ECWMIN to 7. So if I put this filter, I get packets which has WMM param ECWMIN equal to 7 for either best effort/backgroun/voice/video.

Above display filter is changed to: wlan_mgt.wfa.ie.wme.acp.ecw.min. here I can't mention for which access category I need!

I'm surprised by this change. Is it a bug? Can I request for enhancement?

params wmm

asked 10 Oct '13, 11:30

Ramprasad
20●10●11●15
accept rate: 0%

edited 10 Oct '13, 11:31

One Answer:

I searched the trunk-1.2 sources (as well as all other trunks) for a filter named wlan_mgt.wme.be.ac_param.ecwmin and came up empty. It's not listed anywhere on the on-line Wireshark display filter reference page either, at least not as far as I can tell. Running tshark -G fields | grep "wlan_mgt\.wme\.be\.ac_param\.ecwmin" also comes up empty. The supposed replacement filter of wlan_mgt.wfa.ie.wme.acp.ecw.min was first introduced with r37486, and as far as I can tell, wasn't a rename of the previous filter but an entirely new one.

So maybe you can help point to where that filter previously existed because I can't find any reference to it anywhere.

answered 11 Oct '13, 10:32

cmaynard ♦♦
9.4k●10●38●142
accept rate: 20%

Yes, possible. The current version we are using is customized to meet our needs. Probably this is part of it.

Assuming this is never present, could you think of any other solution to above problem? i.e. to filter packets based on value for a particular access category?, which is not possible with current granularity level we have?

(13 Oct '13, 09:04) Ramprasad

could you think of any other solution to above problem?

I can think of a few solutions to your problem. You could:

Continue to use the version you were using before that provided the functionality that you're looking for.
Implement the functionality that you need yourself.
Open a bug report and attach a patch that implements the functionality you desire so that once it's committed to the Wireshark repository you won't have to worry about this anymore.
Open a bug report asking for an enhancement for this new functionality if you are unable to provide a patch yourself, then hope that one day somebody implements this for you.
Hire someone to implement the desired functionality if you're unable to do it yourself and are unwilling to wait for someone else in the Wireshark community to maybe implement it one day.

(14 Oct '13, 16:43) cmaynard ♦♦