Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.
Wireshark logo

Ethereal-users: Re: [Ethereal-users] Filter fragmented packets

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: "Mark C. Brown" <mbrown@xxxxxxxxxx>
Date: Sat, 30 Oct 2004 12:45:40 -0400
On Sat, 2004-10-30 at 11:49, Suja Prabha wrote:
> Can someone tell me how to filter out the fragmented packets from the
> data that I have captured?

ip.frag_offset==0

This will give you all first fragments and non-fragments.

If you only want first fragments:

ip.flags.mf==1 && ip.frag_offset==0

-- 
"If a train station is where a train stops, | Mark C. Brown
 then what's a workstation?" -- D. Huber    | mbrown@xxxxxxxxxx
Wireshark logo footer

© Wireshark Foundation · Privacy Policy

Facebook·Mastodon·Twitter·YouTube