# DO NOT EDIT THIS FILE!  It was created by Wireshark
@802.11 Retry Frame@wlan.fc.retry == 1@[65535,8738,8738][0,0,0]
@Device Going To Sleep@wlan.fc.pwrmgt == 1@[0,0,65535][65535,65535,65535]
@802.11 Beacon@wlan.fc.type_subtype == 8@[65535,65535,0][0,0,0]
@802.11 Probe Request@wlan.fc.type_subtype == 4@[53199,62708,65535][0,0,0]
@802.11 Probe Response@wlan.fc.type_subtype == 5@[39321,58596,65535][0,0,0]
@802.11 Auth@wlan.fc.type_subtype == 11@[9509,38550,65535][0,0,0]
@802.11 Association Request@wlan.fc.type_subtype == 0@[47288,53713,65535][0,0,0]
@802.11 Association Response@wlan.fc.type_subtype == 1@[33667,43690,65535][0,0,0]
@802.11 ReAssociation Request@wlan.fc.type_subtype == 2@[47288,53713,65535][0,0,0]
@802.11 ReAssociation Response@wlan.fc.type_subtype == 3@[33667,43690,65535][0,0,0]
@EAP@eap@[65535,54741,0][0,0,0]
@EAPOL@eapol@[54998,65535,42662][0,0,0]
@802.11 QoS Data Frame@wlan.fc.type_subtype == 40@[0,49087,3855][0,0,0]
@802.11 QoS Data + CF-Ack@wlan.fc.type_subtype == 41@[13621,56797,16705][0,0,0]
@802.11 QoS Data + CF-Poll@wlan.fc.type_subtype == 42@[13621,56797,16705][0,0,0]
@802.11 QoS Data + CF-Ack + CF-Poll@wlan.fc.type_subtype == 43@[13621,56797,16705][0,0,0]
@QoS CF-Poll No Data@wlan.fc.type_subtype == 46@[31868,65021,35723][0,0,0]
@802.11 QoS Data + CF-Ack + CF-Poll No Data@wlan.fc.type_subtype == 47@[31868,65021,35723][0,0,0]
@802.11 QoS NULL Data@wlan.fc.type_subtype == 44@[31868,65021,35723][0,0,0]
@802.11 NULL Data@wlan.fc.type_subtype == 36@[31868,65021,35723][0,0,0]
@802.11  ACK@wlan.fc.type_subtype == 29@[53199,65535,19275][0,0,0]
@802.11 CTS@wlan.fc.type_subtype == 28@[60395,49344,30069][0,0,0]
@802.11 RTS@wlan.fc.type_subtype == 27@[51914,42405,25957][0,0,0]
@Aruba ARM Over-The_Air Update@wlan.fc.type_subtype == 15@[65535,36494,771][0,0,0]
@802.11 Power-Save Poll@wlan.fc.type_subtype == 26@[11051,19275,65535][0,0,0]
@Beamforming Report Poll@wlan.fc.type_subtype == 20@[28527,65535,65535][0,0,0]
@VHT NDP Announcement@wlan.fc.type_subtype == 21@[10537,62965,65535][0,0,0]
@VHT Compressed Beamforming Report@wlan.vht.action == 0@[8995,55512,57054][0,0,0]
@VHT Group ID Management@wlan.vht.action == 1@[7453,47288,47802][0,0,0]
@802.11 Disassociation@wlan.fc.type_subtype == 10@[65535,16962,44461][0,0,0]
@802.11 Deauthentication@wlan.fc.type_subtype == 12@[65535,0,39321][0,0,0]
@Block Ack Req@wlan.fc.type_subtype == 24@[60652,55512,65535][0,0,0]
@Block Ack Resp@wlan.fc.type_subtype == 25@[54741,44975,65535][0,0,0]
@AddBA Request@wlan.fixed.action_code == 0@[60652,55512,65535][0,0,0]
@AddBA Response@wlan.fixed.action_code == 1@[54741,44975,65535][0,0,0]
@DELBA@wlan.fixed.action_code == 2@[46260,19275,65535][0,0,0]
@11v BSS Transition Mgmt Query@wlan.fixed.action_code == 6@[34695,65535,55255][0,0,0]
@11v BSS Transition Mgmt Request@wlan.fixed.action_code == 7@[29041,54998,46517][0,0,0]
@11v BSS Transition Mgmt Response@wlan.fixed.action_code == 8@[22873,43176,36494][0,0,0]
@11k Radio Measurement Request@wlan.rm.action_code == 0@[65535,58082,61166][0,0,0]
@11k Radio Measurement Report@wlan.rm.action_code == 1@[65535,44204,50629][0,0,0]
@11k Link Measurement Request@wlan.rm.action_code == 2@[65535,58082,61166][0,0,0]
@11k Link Measurement Response@wlan.rm.action_code == 3@[65535,44204,50629][0,0,0]
@11k Neighbor Report Request@wlan.rm.action_code == 4@[65535,58082,61166][0,0,0]
@11k Neighbor Report Response@wlan.rm.action_code == 5@[65535,44204,50629][0,0,0]
!@Bad TCP@tcp.analysis.flags && !tcp.analysis.window_update@[4626,10023,11822][63479,34695,34695]
!@HSRP State Change@hsrp.state != 8 && hsrp.state != 16@[4626,10023,11822][65535,64764,40092]
!@Spanning Tree Topology  Change@stp.type == 0x80@[4626,10023,11822][65535,64764,40092]
!@OSPF State Change@ospf.msg != 1@[4626,10023,11822][65535,64764,40092]
!@ICMP errors@icmp.type eq 3 || icmp.type eq 4 || icmp.type eq 5 || icmp.type eq 11 || icmpv6.type eq 1 || icmpv6.type eq 2 || icmpv6.type eq 3 || icmpv6.type eq 4@[4626,10023,11822][47031,63479,29812]
!@ARP@arp@[64250,61680,55255][4626,10023,11822]
!@ICMP@icmp || icmpv6@[64764,57568,65535][4626,10023,11822]
!@TCP RST@tcp.flags.reset eq 1@[42148,0,0][65535,64764,40092]
!@SCTP ABORT@sctp.chunk_type eq ABORT@[42148,0,0][65535,64764,40092]
!@TTL low or unexpected@( ! ip.dst == 224.0.0.0/4 && ip.ttl < 5 && !pim && !ospf) || (ip.dst == 224.0.0.0/24 && ip.dst != 224.0.0.251 && ip.ttl != 1 && !(vrrp || carp))@[42148,0,0][60652,61680,60395]
!@Checksum Errors@eth.fcs.status=="Bad" || ip.checksum.status=="Bad" || tcp.checksum.status=="Bad" || udp.checksum.status=="Bad" || sctp.checksum.status=="Bad" || mstp.checksum.status=="Bad" || cdp.checksum.status=="Bad" || edp.checksum.status=="Bad" || wlan.fcs.status=="Bad" || stt.checksum.status=="Bad"@[4626,10023,11822][63479,34695,34695]
!@SMB@smb || nbss || nbns || nbipx || ipxsap || netbios@[65278,65535,53456][4626,10023,11822]
!@HTTP@http || tcp.port == 80 || http2@[58596,65535,51143][4626,10023,11822]
!@IPX@ipx || spx@[65535,58339,58853][4626,10023,11822]
!@DCERPC@dcerpc@[51143,38807,65535][4626,10023,11822]
!@Routing@hsrp || eigrp || ospf || bgp || cdp || vrrp || carp || gvrp || igmp || ismp@[65535,62451,54998][4626,10023,11822]
!@TCP SYN/FIN@tcp.flags & 0x02 || tcp.flags.fin == 1@[41120,41120,41120][4626,10023,11822]
!@TCP@tcp@[59367,59110,65535][4626,10023,11822]
!@UDP@udp@[56026,61166,65535][4626,10023,11822]
!@Broadcast@eth[0] & 1@[65535,65535,65535][47802,48573,46774]