ip.flags.sf not supported?

asked 2018-04-18 19:04:21 +0000

tdodd
1

I'm running wireshark 2.4.6. I see that 'ip.flags.sf' is listed as supported in the docs, but when I actually try to use this display filter it doesn't give expected results:

'ip.flags.sf' is accepted, but doesn't match any ipv4 packets 'ip.flags.sf==0' also is accepted but doesn't match anything

Drilling down in an ipv4 packet, I see flags expanded into the bits for reserved, DF, and MF: no mention of the security flag. I've done a bit of online searching, and haven't been able to find any references to the 'security' flag outside of this 15-year-old rfc: https://datatracker.ietf.org/doc/rfc3....

So does anyone know the status of this flag and the corresponding display filter identifier?

edit retag flag offensive close merge delete

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2018-04-18 23:34:37 +0000

Jim Aragon
7512 ●7 ●71 ●128 Fairfield, California

RFC 3514, which you already found, is the whole story. Before you enable the preference or try to filter on that field, go back to RFC 3514 and note the date that it was issued.