First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

I want to create a filter where I compare two protocol fields in different layers. Anyone know how?

  • retag add tags

The answer is not display filter macros. Nor is the answer MATE.

Example compare (eth.src <> icmpv6.opt.linkaddr) - this would be the not equal example, replace <> with == for the equal fields. One field is in the L2 header - the other is in the L3 headers.

So I run this display filter and I will be shown all packets where these two items do not equal (in reality I would have to add the 'icmpv6 &&' so that the compare would function properly.

Thanks in advance for an answer to this!

AndyW's avatar
1
AndyW
asked 2018-06-28 17:24:07 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

0

think I answered my own question:

(eth.src[:6] == icmpv6.opt.linkaddr[:6]) for the equal to

(eth.src[:6] != icmpv6.opt.linkaddr[:6]) for the not equal to

AndyW's avatar
1
AndyW
answered 2018-06-28 17:36:59 +0000
edit flag offensive 0 remove flag delete link
more

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer