How do I find two consecutive frames from the same IP source address

edit

Need more coffee. Took a bit for that to click. :-)
Display Filter comparison operators
bitwise_and & Bitwise AND is non-zero tcp.flags & 0x02

The frame number comparison will fail if there is traffic in the capture other than that being tested.

@grahamb True, it will fail if there is other traffic, but I took the original question literally:

I have a capture file where two source addresses normally alternate so frame.number will increment and the ip.src will alternate between the two addresses.

Thanks Graham, I really appreciate the answer and the quick response, Regards, Roche

If it's a one off, tshark with a script or into a spreadsheet is probably quickest.

If something to be done on a regular basis (and ok with Lua), look at ip_src_alternate.lua in the Contrib section of the Wireshark Wiki

Sometimes you can solve this kind of problem if the higher level protocol dissectors have a "request in/answer in" field, and filter on all request packets which have no "answer in" field (e.g. ICMP echo request packets).

You may be able to visually spot the condition by plotting it using Statistics -> I/O Graphs. Add 2 graph entries:

• IP Source 1, ip.src eq x.x.x.x, Y Axis = Packets
• IP Source 2, ip.src eq y.y.y.y, Y Axis = Packets

In the normal case, you should see alternating spikes; in the fault condition, they won't alternate. You may need to adjust the Colors, Styles and Interval setting to better see the 2 distinct plots, depending on your needs.

Another idea where you might be able to spot the fault condition visually would be to apply a new coloring rule (View -> Coloring Rules) for packets matching IP Source 1 and a different coloring rule for packets matching IP Source 2.