Yes a duplicate beacon would have the same SSID. I want to be able to pull information from each beacon frame; but if the information already exists in the database then I don't want to even touch that frame. Hence, if I could sort out the duplicates before I parse the information I wouldn't have to write so many inefficient nested queries.
From the desk of Nicole A. Powell.....
> From: guy@xxxxxxxxxxxx
> To: wireshark-users@xxxxxxxxxxxxx
> Date: Thu, 29 Oct 2009 09:16:27 -0700
> Subject: Re: [Wireshark-users] Unique filters
>
>
> On Oct 29, 2009, at 7:54 AM, Nicole Powell wrote:
>
> > That filter does not provide the information that I am looking for.
> > For example, I want to be able to apply this filter 'wlan.fc.subtype
> > == 8' and see all the unique beacon frames because I need to parse
> > certain information into a database. I thought maybe there was a
> > 'sort unique' phrase I could add to that filter to do that.
>
> No, filters only filter, they don't sort, and they act on each packet
> individually, just acting on individual fields in a packet; there's no
> history of the sort that would be needed to filter out duplicates.
>
> What's the definition of a duplicate beacon here? Same SSID? And
> what's the information you want to put into the database?
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
|