First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

filter top sequense

Hello I wanted to know if there is a filter that allows me to see the highest frame, for example the sq field of some protocol sq: 20 sq: 21 sq: 22 sq: 23 the filter would only show me on the 24th and when the sequence 25 arrives this is the one that would show.

Thanks for your audacity

LONCHOROJAS's avatar
1
LONCHOROJAS
asked 2018-05-31 20:09:30 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

0

No, that is currently not possible, because it would require that the filter engine compares fields in multiple packets. Right now it can only look for filter matches at one packet at any given time, so any correlation between packets needs to have been hard coded and checked during reading them (e.g. like echo request/echo reply for ICMP ping packet).

Jasper's avatar
24.1k
Jasper
answered 2018-06-02 09:00:18 +0000
edit flag offensive 0 remove flag delete link
more

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer