filter 'type XXX subtype YYY' does not work anymore

[solsticedhiver]

Either with tcpdump 4.99 or libpcap 1.10, a (bpf) filter of type mgt subtype probe-req gives the error:

unknown 802.11 type

Previous versions of the tool did not give such error.

As a work-around, one have to use subtype probe-req only as filter

[mcr]

Hmm. Clearly we need a test case for this. Ideally it would include a pcap file that contains a packet of the type that you want to match. It's probably a libpcap regression.

[solsticedhiver]

libpcap bails out when running pcap_compile. I can post a working C file for this, but I thought the bug is clear enough

and for tcpdump, it is as simple as running:

# tcpdump -i wlan0mon 'type mgt subtype prob-req'
tcpdump: unknown 802.11 type

I think tcpdump does not even try to filter anything, and errors out like pcap_compile so a pcap file is not relevant.

[guyharris]

1. The bug is easy to reproduce using the filtertest test program in the testprogs directory (testprogs/filtertest IEEE802_11 type mgt subtype prob-req).
2. Tcpdump prints that message because there's a bug in libpcap - this bug.
3. Fix incoming.

[guyharris]

Fixed in 6ff5d20.

[linxcow]

1. The bug is easy to reproduce using the filtertest test program in the testprogs directory (testprogs/filtertest IEEE802_11 type mgt subtype prob-req).

   2. Tcpdump prints that message because there's a bug in libpcap - this bug.

   3. Fix incoming.

In which release of libpcap is this fix incorporated?

[fxlb]

In which release of libpcap is this fix incorporated?

libpcap 1.10.1 or later.