I want to create a filter where I compare two protocol fields in different layers. Anyone know how?
The answer is not display filter macros. Nor is the answer MATE.
Example compare (eth.src <> icmpv6.opt.linkaddr) - this would be the not equal example, replace <> with == for the equal fields. One field is in the L2 header - the other is in the L3 headers.
So I run this display filter and I will be shown all packets where these two items do not equal (in reality I would have to add the 'icmpv6 &&' so that the compare would function properly.
Thanks in advance for an answer to this!