On 8/30/05, Guy Harris <gharris@xxxxxxxxx> wrote:
> David Meagher wrote:
>
> > Does any one know is it possible to do any level of scripting in ethereal?
> > i've got a few 100mb+ captures, which takes a while to filter through
> > to find what i'm looking for.
> >
> > to do something like:
> > ip.addr == (select radius.Framed_IP_Address from radius where
> > radius.Calling_Station_Id == "1234567890")
>
> That's not really an application for scripting; it'd just be a display
> filter
>
> radius.Calling_Station_Id == "1234567890" and ip.addr ==
> radius.Framed_IP_Address
That would yield the radius packet authorizing the NAS that calls
itself to log in... Not very useful...
> but, unfortunately, we don't support comparing two fields in that
> fashion. I don't know whether it's difficult to support that or not in
> the display filter mechanism, but if it can be done without breaking
> other things, that's something we should probably do at some point.
As far as I understand there's at least one nasty issue to solve:
by now in
radius.Framed_IP_Address == ip.addr
ip.addr would be considered an ip address (by name) or a string (?) so
either we drop the ability to use unquoted literal strings and address
resolution or we have a hard to solve ambiguity.
L
--
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan