05-29-2016 01:50 AM
doesn't have a direct answer, it could be wireshark isn't decoding the information correctly because it changes. not sure if the protocol IAP uses is publicly documented.
06-01-2016 07:25 PM
indeed the wireshark decoder is buggy, Alex (author) is aware but Aruba were not prepared to allow the protocol to be decoded and so it is only able to be reverse engineered. You can actually pick out some of the fields like IP address of the master. Having said that, at the end of the day, the IAP beacon protocol isnt particularly interesting to decode, the AP logs will give you much more useful info.