Ethereal-dev: Re: [Ethereal-dev] Bug in ethereal filtering on DF (Don't Fragment) flag?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Andy Fingerhut <jafingerhut@xxxxxxx>
Date: Thu, 31 Mar 2005 09:05:58 -0800
Guy Harris wrote:
ronnie sahlberg wrote:

the filter   "ip.flags.df"   will check if the field DF exists in the
packet or not, regardless of what value it has (i.e. if it is SET or
CLEAR).
It will essentially find all IP packets  since every IP packet has a
DF flag (which is either SET or CLEAR).


...and if you want to check whether it's *set*, you do:

    ip.flags.df == 1

or, to check whether it's *clear*:

    ip.flags.df == 0

I.e., even for Boolean variables, you have to test with == to test the value; the name of a field, by itself, tests whether the field is present or not, not whether, if it's Boolean, it's set.



Thanks for the clarifications. My apologies for asking about the 'ip.flags.df' conditions -- for those I should have understood that behavior from the docs.

What I'm still a little surprised about is the case where I tried this:

'ip.flags.df == 1'

and got out *both* packets. I fully expected to get out the first packet, because it has DF=1 in its IP header. It seems very strange to me that I also get out the second packet. It is ICMP, and has DF=0 in its IP header, but I'm guessing from Ronnie Sahlberg's message that the packet is passing the filter because the ICMP message contains an IP header in its payload, and *that* IP header has DF=1. Is that the reason it passes the filter?

If so, is there a way to specify a filter that restricts its attention to the outermost IP header, ignoring inner IP headers? Or in general that lets you pick which level of IP header you want to test fields in? Perhaps something like this?

ip.ip.flags.df == 1

Where that would only match packets that have an outer IPv4 header, and inner IPv4 header, and the inner IPv4 header had DF=1?

Thanks,
Andy Fingerhut