I can't filter displayed frames where specific byte is equal ff or fc (eq. frame[4] == ff), the filter sequence is not allowed, filter window turns red. Any solution, please?

asked 01 Dec '11, 02:12

Jenda%20Nespor's gravatar image

Jenda Nespor
1112
accept rate: 0%


The problem is because both fc and ff are filters on their own, for "FOUNDATION Fieldbus" and "Fibre Channel", respectively. You should be able to work around it using frame[4] == ff:

link

answered 01 Dec '11, 07:22

cmaynard's gravatar image

cmaynard ♦
3.2k51656
accept rate: 15%

edited 01 Dec '11, 07:33

Good to know. Still I think this behavior is a little strange to work with; isn't it possible to look at fc and ff as values instead of as filter names?

(01 Dec '11, 07:56) Jasper ♦

Well, it's only a problem for single bytes. If you were searching for 2 (or more) bytes, then frame[4:2]==ff:fc would work just fine without the trailing colon.

But I do agree with you, and I think there is very likely a bug here since the display filter parsing doesn't support display filters on the right-hand side of a comparison operator anyway, at least as far as I'm aware, so it shouldn't be trying to match a filter here. You might want to file a bug report about this.

(01 Dec '11, 09:03) cmaynard ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×128
×20
×9

Asked: 01 Dec '11, 02:12

Seen: 1,172 times

Last updated: 01 Dec '11, 09:03

powered by OSQA