How can I make display filter conditions to the same datagram?

asked 2020-03-19 19:24:43 +0000

NCTuser gravatar image

updated 2020-03-19 19:26:03 +0000

If I use the filter expression ecat.cmd == BRD && ecat.data == 0c:00 the wireshark will show the frames in which there is a datagram with BRD command and a datagram with data 0c:00 but these two conditions not necessary true for the same datagram. How can I filter the frames where there is datagram whereat both conditions are true? I know the ecat.sub1, ecat.sub2, ... fields but I do not know the exact position of the datagram in the frame. Maybe it is possible by using Lua script?

edit retag flag offensive close merge delete

Comments

EtherCAT can have multiple datagrams per frame.
You would like the filter to match frames only where the two conditions are in the same datagram.
If Wireshark display filters supported field occurrence then this might be possible.
An upvote for the bugs in this Ask question might help to get it added.

bubbasnmp gravatar imagebubbasnmp ( 2020-03-19 20:02:32 +0000 )edit