Re: Filtering Question

[Christopher Maynard <Christopher.Maynard () gtech com>]

Jonathan S. Weissman <jsw52@...> writes:

> What's the difference between ip.src and ip.src_host (and ip.dst and
ip.dst_host and ip.addr vs ip.host)?
> They return the same results, so what exactly does the "type" do?

If you enable network name resolution and the IP address resolves to a host
name, you will more easily see the difference.  But even without resolving to a
host name, the difference is illustrated below:

Without network name resolution enabled:
ip.src == 67.228.110.120
ip.src_host == "67.228.110.120"

With network name resolution enabled:
ip.src == 67.228.110.120
ip.src_host == "www.wireshark.org"

The format expected for the first is an IP address and the format expected for
the second is a character string.

- Chris




___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe