Ethereal-dev: Re: [Ethereal-dev] more frags / don't frag bits

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <gharris@xxxxxxxxx>
Date: Thu, 17 Jan 2002 00:20:59 -0800
On Tue, Jan 15, 2002 at 12:55:47PM -0500, Vincent Berk wrote:
> I couldn't find this bug reported anywhere yet.
> Building a filter using:
> 
>     ip.flags.mf
> 
> Checks for IP flags to be 0x04, this should be 0x02.

On which version of Ethereal do you see this, and what filter expression
were you using?

In the current version of Ethereal, the filter expression

	ip.flags.mf

checks whether the packet has a "more fragments" field, *regardless of
whether it's zero or one*.  I.e., it, in effects, checks whether the IP
flags are present at all, not whether it has the 0x04 or the 0x02 bit
set.

The filter expression

	ip.flags.mf == 1

tests whether that flag is set; the expression

	ip.flags.mf == 0

tests whether it's clear.

That appears to work on at least one capture I have.