Wireshark mailing list archives

Re: capture filter

From: Tony Trinh <tony19 () gmail com>
Date: Wed, 28 Sep 2011 22:04:38 -0400

I think these work:

*IPv4*
ip[12:4] != ip[16:4]


*IPv6*
ip[8:8] != ip[16:8]



On Wed, Sep 28, 2011 at 9:25 PM, Andrej van der Zee <
andrejvanderzee () gmail com> wrote:

Hi,

I am looking for a capture filter equal to the display filter "ip.src
!= ip.dst". How can I do this?

Cheers,
Andrej
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request () wireshark org
?subject=unsubscribe

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe

Current thread:

Capture filter Tharaneedharan Vilwanathan (Sep 15)
- Re: Capture filter Tharaneedharan Vilwanathan (Sep 16)
- Re: Capture filter Chris Maynard (Sep 16)
- <Possible follow-ups>
- capture filter Andrej van der Zee (Sep 28)
  - Re: capture filter Tony Trinh (Sep 28)
    - Re: capture filter Andrej van der Zee (Sep 28)
    - Re: capture filter Guy Harris (Sep 28)
    - Re: capture filter Andrej van der Zee (Sep 28)