Revision history [back]

Hi Niels, did you try to do a filter like @cmaynard recommended (slice operator)?

For example this filter: arp.src.proto_ipv4[3] == c

Also I suspect when you use arp.src.proto_ipv4 ==x you're actually look for the servers that have IP ending with 12 themselves.

Probably you have to use arp.dst.proto_ipv4[3] ==c for matching target IP address?

Hi Niels, did you try to do make a filter like @cmaynard recommended (slice operator)?

For example this filter: arp.src.proto_ipv4[3] == c

Also I suspect when you use arp.src.proto_ipv4 ==x you're actually look for the servers that have IP ending with 12 themselves.

Probably you have to use arp.dst.proto_ipv4[3] ==c for matching target IP address?

Hi Niels, did you try to make a filter like @cmaynard recommended (slice operator)?

For example this filter: arp.src.proto_ipv4[3] == c

Also I suspect when you use arp.src.proto_ipv4 ==x you're actually look looking for the servers that have IP ending with 12 themselves.

Probably you have to use arp.dst.proto_ipv4[3] ==c for matching target IP address?

Hi Niels, did you try to make a filter like @cmaynard recommended (slice operator)?

For example this filter: arp.src.proto_ipv4[3] == c

Also I suspect when you use arp.src.proto_ipv4 ==x you're actually looking for the servers that have IP ending with 12 themselves.

Probably you have to use arp.dst.proto_ipv4[3] ==c for matching target IP address?address? And make a column for "sender IP address" (arp.src.proto_ipv4)