Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] Filtering on a field when there is more than one such field in a

From: Richard Sharpe <realrichardsharpe@xxxxxxxxx>
Date: Thu, 13 Aug 2020 13:12:29 -0700
Hi folks,

I faced an interesting problem recently.

I was typing to find a particular tagged item with a tag length
greater than a specific size.

This presented a problem because many Wi-Fi packets have tagged fields
and a search filter like wlan.tag.number == X and wlan.tag.length >=
some-value is prone to false positives if any tagged field in the
frame has that number and any other tagged field in the frame has a
length ge the value.

How can I limit the length comparison to the tag found in the first comparison?

Do we even have that concept?

-- 
Regards,
Richard Sharpe
(何以解憂?唯有杜康。--曹操)(传说杜康是酒的发明者)