Wireshark-users: Re: [Wireshark-users] Unique filters

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 29 Oct 2009 09:16:27 -0700

On Oct 29, 2009, at 7:54 AM, Nicole Powell wrote:

That filter does not provide the information that I am looking for. For example, I want to be able to apply this filter 'wlan.fc.subtype == 8' and see all the unique beacon frames because I need to parse certain information into a database. I thought maybe there was a 'sort unique' phrase I could add to that filter to do that.

No, filters only filter, they don't sort, and they act on each packet individually, just acting on individual fields in a packet; there's no history of the sort that would be needed to filter out duplicates.

What's the definition of a duplicate beacon here? Same SSID? And what's the information you want to put into the database?