Wireshark-users: Re: [Wireshark-users] capture filter

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Andrej van der Zee <andrejvanderzee@xxxxxxxxx>
Date: Thu, 29 Sep 2011 04:18:55 +0200
> IPv4
> ip[12:4] != ip[16:4]

This seems to work indeed.

Should I read this as "4 bytes from offset 12 != 4 bytes from offset
16", relative to the start of the IP-header? Must be, as these are the
sizes and positions of the src and dst address. I wasn't aware that
byte-wise comparison like this was possible. Nice!

Thanks!
Andrej