Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

I want to create a filter where I compare two protocol fields in different layers. Anyone know how?

The answer is not display filter macros. Nor is the answer MATE.

Example compare (eth.src <> icmpv6.opt.linkaddr) - this would be the not equal example, replace <> with == for the equal fields. One field is in the L2 header - the other is in the L3 headers.

So I run this display filter and I will be shown all packets where these two items do not equal (in reality I would have to add the 'icmpv6 &&' so that the compare would function properly.

Thanks in advance for an answer to this!