Wireshark-users: Re: [Wireshark-users] "radius.MAC_Address" renamed to "radius.Mac_Addr"?
From: Bill Meier <wmeier@xxxxxxxxxxx>
Date: Sun, 03 Jun 2012 20:57:19 -0400
On 6/3/2012 5:20 PM, René Scheibe wrote:
Hi,

I just upgraded from 1.2.15 to 1.6.8 and was wondering why and where
"radius.MAC_Address" was renamed to "radius.Mac_Addr"?

I cannot find either to old or the new field name in any Radius
dictionary file. Is this hardcoded somewhere in the sources? (I could
not find it there too.) I only saw the change mentioned on the webpage
in the Radius reference list.

Regards,
René Scheibe


This field is defined in dictionary.redback


ATTRIBUTE	Mac-Addr				145	string



The change from 'MAC_Address' to 'Mac-Addr' was made as part of SVN 28996


r28996 | wmeier | 2009-07-07 13:52:03 -0400 (Tue, 07 Jul 2009) | 3 lines

Update dictionary files from FreeRadius 2.1.6 [5/18/09]: part 2:
Modified files w/o conflicts with current Wireshark radius dictionary files.


(Aside: Not previously having looked at this part of the radius code it surprises me a bit that the radius 'filter names' derived from the attribute names aren't qualified by the 'vendor name'.

Maybe the 'hf[]' array entries generated from the dictionay files are really only intended to be used for specifying the 'display' format in the packet-details display and thus the filter names aren't really intended to be used).