Revision history  [back]

Hi Niels, did you try to make a filter like @cmaynard recommended (slice operator)?

For example this filter: arp.src.proto_ipv4[3] == c

Also I suspect when you use arp.src.proto_ipv4 ==x you're actually looking for the servers that have IP ending with 12 themselves.

Probably you have to use arp.dst.proto_ipv4[3] ==c for matching target IP address? And make a column for "sender IP address" (arp.src.proto_ipv4)address?

Hi Niels, did you try to make a filter like @cmaynard recommended (slice operator)?

For example this filter: arp.src.proto_ipv4[3] == c

Also I suspect when you use arp.src.proto_ipv4 ==x you're actually looking look for the servers that have IP ending with 12 themselves.

Probably you have to use arp.dst.proto_ipv4[3] ==c for matching target IP address?

Hi Niels, did you try to make do a filter like @cmaynard recommended (slice operator)?

For example this filter: arp.src.proto_ipv4[3] == c

Also I suspect when you use arp.src.proto_ipv4 ==x you're actually look for the servers that have IP ending with 12 themselves.

Probably you have to use arp.dst.proto_ipv4[3] ==c for matching target IP address?