Ethereal-users: Re: [Ethereal-users] Filter rule deping on privious packet?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <gharris@xxxxxxxxx>
Date: Fri, 03 Mar 2006 01:28:06 -0800
Guenther Lackner wrote:


I need a filter rule which filters out a packet depending if the
priviously captured packet does not contain a certain destination address.

Is there a possibility to do this with the ethereal filter rules?
No - the Ethereal filter language is stateless, and an expression can only test the values in a single packet, not values in previous packets. (The same is true of the libpcap/WinPcap capture filter language.)