The reason is simple.
The field specifid is the field we want to perform the operation/calculation
on.
In order to be able to extract the value of that field from the packet
dissection engine, that value
must be part of the filter we use. Since otherwise the packet dissection
subsystem will
forget about the value before we can inspect it.
the reason we must add the field variable and make it part of the filter is
because no one has written
code yet to make that happen automatically in the background.
----- Original Message -----
From: "Michael Tuexen"
Sent: Monday, March 08, 2004 4:03 AM
Subject: Re: [Ethereal-dev] IO Stat
> I was using ethereal. I do not understand why I have
> to provide two filters, one is a substring of the other.
>
> Best regards
> Michael
>
>
> On Mar 7, 2004, at 12:28 AM, Richard Sharpe wrote:
>
> > On Thu, 26 Feb 2004, Ronnie Sahlberg wrote:
> >
> >> Use "tcp&&ip.len" as the filter and use "ip.len" as the field.
> >>
> >> the field variable must be part of the filter string
> >
> > Ummm, what exactly does that mean? Is this with Ethereal or Tethereal?
> >
> >> ----- Original Message -----
> >> From: "Michael Tuexen"
> >> Sent: Thursday, February 26, 2004 2:37 AM
> >> Subject: [Ethereal-dev] IO Stat
> >>
> >>
> >>> Dear all,
> >>>
> >>> how do I use the IO stat advanced stuff to plot the sum of ip.len for
> >>> all
> >>> packets containing tcp. I tried to use tcp as a filter and ip.len as
> >>> the
> >>> field, but this does not work.
> >>>
> >>> Thank you very much for your help.
> >>>
> >>> Best regards
> >>> Michael
> >>>
> >>> _______________________________________________
> >>> Ethereal-dev mailing list
> >>> Ethereal-dev@xxxxxxxxxxxx
> >>> http://www.ethereal.com/mailman/listinfo/ethereal-dev
> >>
> >> _______________________________________________
> >> Ethereal-dev mailing list
> >> Ethereal-dev@xxxxxxxxxxxx
> >> http://www.ethereal.com/mailman/listinfo/ethereal-dev
> >>
> >
> > --
> > Regards
> > -----
> > Richard Sharpe, rsharpe[at]richardsharpe.com, rsharpe[at]samba.org,
> > sharpe[at]ethereal.com, http://www.richardsharpe.com
> >
> > _______________________________________________
> > Ethereal-dev mailing list
> > Ethereal-dev@xxxxxxxxxxxx
> > http://www.ethereal.com/mailman/listinfo/ethereal-dev
> >
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev