Re: capture filter

[Andrej van der Zee <andrejvanderzee () gmail com>]

> IPv4
> ip[12:4] != ip[16:4]

This seems to work indeed.

Should I read this as "4 bytes from offset 12 != 4 bytes from offset
16", relative to the start of the IP-header? Must be, as these are the
sizes and positions of the src and dst address. I wasn't aware that
byte-wise comparison like this was possible. Nice!

Thanks!
Andrej
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe