Ask Your Question

ip.flags.sf not supported?

asked 2018-04-18 19:04:21 +0000

tdodd gravatar image

I'm running wireshark 2.4.6. I see that 'ip.flags.sf' is listed as supported in the docs, but when I actually try to use this display filter it doesn't give expected results:

'ip.flags.sf' is accepted, but doesn't match any ipv4 packets 'ip.flags.sf==0' also is accepted but doesn't match anything

Drilling down in an ipv4 packet, I see flags expanded into the bits for reserved, DF, and MF: no mention of the security flag. I've done a bit of online searching, and haven't been able to find any references to the 'security' flag outside of this 15-year-old rfc:

So does anyone know the status of this flag and the corresponding display filter identifier?

edit retag flag offensive close merge delete

2 Answers

Sort by ยป oldest newest most voted

answered 2018-04-18 23:34:37 +0000

Jim Aragon gravatar image

RFC 3514, which you already found, is the whole story. Before you enable the preference or try to filter on that field, go back to RFC 3514 and note the date that it was issued.

edit flag offensive delete link more


Thanks. I did notice the date. I just didn't get the joke.

tdodd gravatar imagetdodd ( 2018-04-19 13:05:40 +0000 )edit

answered 2018-04-18 20:09:44 +0000

Jaap gravatar image

This field becomes available only when explicitly enabled in the preferences.

edit flag offensive delete link more


Thank you!

tdodd gravatar imagetdodd ( 2018-04-18 21:38:39 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2018-04-18 19:04:21 +0000

Seen: 453 times

Last updated: Apr 18 '18