Wireshark · Ethereal-dev: Re: [Ethereal-dev] Bug in ethereal filtering on DF (Don't Fragment) flag?

[Guy Harris <gharris@xxxxxxxxx>]

ronnie sahlberg wrote:
> the filter   "ip.flags.df"   will check if the field DF exists in the
> packet or not, regardless of what value it has (i.e. if it is SET or
> CLEAR).
> It will essentially find all IP packets  since every IP packet has a
> DF flag (which is either SET or CLEAR).

...and if you want to check whether it's *set*, you do:

	ip.flags.df == 1

or, to check whether it's *clear*:

	ip.flags.df == 0

I.e., even for Boolean variables, you have to test with == to test the 
value; the name of a field, by itself, tests whether the field is 
present or not, not whether, if it's Boolean, it's set.