Wireshark mailing list archives
Re: capture filter
From: Andrej van der Zee <andrejvanderzee () gmail com>
Date: Thu, 29 Sep 2011 04:18:55 +0200
IPv4 ip[12:4] != ip[16:4]
This seems to work indeed. Should I read this as "4 bytes from offset 12 != 4 bytes from offset 16", relative to the start of the IP-header? Must be, as these are the sizes and positions of the src and dst address. I wasn't aware that byte-wise comparison like this was possible. Nice! Thanks! Andrej ___________________________________________________________________________ Sent via: Wireshark-users mailing list <wireshark-users () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-users Unsubscribe: https://wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-request () wireshark org?subject=unsubscribe
Current thread:
- Capture filter Tharaneedharan Vilwanathan (Sep 15)
- Re: Capture filter Tharaneedharan Vilwanathan (Sep 16)
- Re: Capture filter Chris Maynard (Sep 16)
- <Possible follow-ups>
- capture filter Andrej van der Zee (Sep 28)
- Re: capture filter Tony Trinh (Sep 28)
- Re: capture filter Andrej van der Zee (Sep 28)
- Re: capture filter Guy Harris (Sep 28)
- Re: capture filter Andrej van der Zee (Sep 28)
- Re: capture filter Tony Trinh (Sep 28)