Ask Your Question

I want to create a filter where I compare two protocol fields in different layers. Anyone know how?

asked 2018-06-28 17:24:07 +0000

AndyW gravatar image

The answer is not display filter macros. Nor is the answer MATE.

Example compare (eth.src <> icmpv6.opt.linkaddr) - this would be the not equal example, replace <> with == for the equal fields. One field is in the L2 header - the other is in the L3 headers.

So I run this display filter and I will be shown all packets where these two items do not equal (in reality I would have to add the 'icmpv6 &&' so that the compare would function properly.

Thanks in advance for an answer to this!

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2018-06-28 17:36:59 +0000

AndyW gravatar image

think I answered my own question:

(eth.src[:6] == icmpv6.opt.linkaddr[:6]) for the equal to

(eth.src[:6] != icmpv6.opt.linkaddr[:6]) for the not equal to

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2018-06-28 17:24:07 +0000

Seen: 337 times

Last updated: Jun 28 '18