Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] Support for searching in FT_BYTES or longer bit fields

From: Richard Sharpe <realrichardsharpe@xxxxxxxxx>
Date: Thu, 1 Apr 2021 20:27:33 -0700
Hi folks,

In one of the fields in 802.11az D3.0 there is a bit field that can be
up to 512 bits long, and has padding defined to round it out to the
nearest byte.

This creates some problems with respect to how to insert it so that
users can search on the field.

No one wants to have to enter all 512 bits in order to search.

I can think of several ways to handle this field:

1. Insert each block of 64 bits or less as a bit field. The last block
might be less than 64 bits. Each block might be called
availability_block_n and users would search within each block with
something like wlan.ftm.ista.availability_block_2 == 0x1ff37 or
whatever.

2. Insert the whole lot as an FT_BYTES field but then it seems like
the user will have to enter the whole value, up to 32 bytes if it is
that long.

3. ??? Is there a better way?

-- 
Regards,
Richard Sharpe
(何以解憂?唯有杜康。--曹操)(传说杜康是酒的发明者)