
From the above data, it's clear that the only byte of interest is the 1st byte, so I used the Slice Operator to isolate the 1st byte of that field as follows: wlan.ta. Wlan.ta consists of 6 bytes, numbered 0 through 5.

Since I don't know what is known already and what isn't, I've tried to explain every detail.įirst off, I didn't bother to look at RFC7402 Section 2.1 as mentioned in Issue 17246 that mentioned I just looked at the patterns of interest, namely: XA:XX:XX:XX:XX:XX Have you tried this? (wlan.ta & 2) and !(wlan.ta & 1)ĮDIT: asked for an explanation, so I've added some more details here.
