This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

alc.lct filter is not working

0

Hello

I am using latest version of Wireshark . but alc.lct filter is not working. When i type alc.lct in display filter . Its turning red. Please suggest some fix for this.

Thank You.

asked 16 Dec '15, 21:10

sampath's gravatar image

sampath
1●1●1●1
accept rate: 0%

2 Answers:

0

Please suggest some fix for this.

Use just "lct". "alc.lct" has not been a valid field name in Wireshark since the 1.12 release.

answered 17 Dec '15, 00:40

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k●3●35●196
accept rate: 19%

edited 17 Dec '15, 02:05

seems it was supported for quite a long time...

(17 Dec '15, 00:44) sindy

It hasn't been valid since 1.12.

(17 Dec '15, 02:02) Guy Harris ♦♦

0

I would say your only option is to

  • manually find a packet which that rule used to select when it existed

  • unfold the layers starting from alc upwards (which means downwards in the dissection pane)

  • look at the alc and its encapsulated protocols' fields available (whenever you select a line in the dissection pane which represents a real or forged protocol field, its name can be read in the status line at the bottom of the whole window) and compose a filter which will choose the same packets which the now-missing alc.lct used to choose.

answered 17 Dec '15, 02:11

sindy's gravatar image

sindy
6.0k●4●8●51
accept rate: 24%