Re: Filtering on a field when there is more than one such field in a Wi-Fi packet

[Jaap Keuter <jaap.keuter () xs4all nl>]

Hi Richard,

The display filter engine has no concept of individual instances of a field, either it’s there in a packet or not and 
its value is used in the expression. Where it is in the packet and in what relation to other fields in a display filter 
expression is of no concern of the display filter engine. It is a question that comes up once in a while, so its not 
unheard of, but no one has dared to venture into redoing the whole display filter engine design to make this possible. 
It would at least require an overhaul of the syntax, and I’m not even sure it is possible with the current dissection 
engine design.

Thanks,
Jaap

> On 13 Aug 2020, at 22:12, Richard Sharpe <realrichardsharpe () gmail com> wrote:
>
> Hi folks,
>
> I faced an interesting problem recently.
>
> I was typing to find a particular tagged item with a tag length
> greater than a specific size.
>
> This presented a problem because many Wi-Fi packets have tagged fields
> and a search filter like wlan.tag.number == X and wlan.tag.length >=
> some-value is prone to false positives if any tagged field in the
> frame has that number and any other tagged field in the frame has a
> length ge the value.
>
> How can I limit the length comparison to the tag found in the first comparison?
>
> Do we even have that concept?

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe