Wireshark · Ethereal-dev: Re: [Ethereal-dev] Filtering by a calculated field

["S. Faizi" <sfaizi@xxxxxxx>]

Title: Message

You may be able to do this with a hidden field. As you process each packet, set a hidden field and then later filter on it.

----- Original Message -----

From: Filonenko Alexander-AAF013

To: ethereal-dev@xxxxxxxxxxxx

Sent: Thursday, March 03, 2005 5:00 PM

Subject: [Ethereal-dev] Filtering by a calculated field

Hi,

 

This is a question related to filtering by a calculated field (field that is not present in the frame but can be calculated from fields that are present).

 

Let's say our protocol consists of messages

    A(MAC address, ID, other fields),

    B(MAC address, other fields) and

    C(MAC address, other fields).

 

Only message A contains ID field. Once we receive message A we store association of (MAC address, ID). If we receive message B or C we will try to find (MAC address, ID) association using MAC address as a key, and if found ID can be displayed for messages B and C. Is there a way to also filter messages B and C by ID, if ID is not present but can be calculated?

 

Thank you,

Alex Filonenko

 

 

 

---

_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev