Hello I wanted to know if there is a filter that allows me to see the highest frame, for example the sq field of some protocol sq: 20 sq: 21 sq: 22 sq: 23 the filter would only show me on the 24th and when the sequence 25 arrives this is the one that would show.
Thanks for your audacity
No, that is currently not possible, because it would require that the filter engine compares fields in multiple packets. Right now it can only look for filter matches at one packet at any given time, so any correlation between packets needs to have been hard coded and checked during reading them (e.g. like echo request/echo reply for ICMP ping packet).
Asked: 2018-05-31 20:09:30 +0000
Seen: 522 times
Last updated: Jun 02 '18
