Ethereal-dev: Re: [Ethereal-dev] Read filter using eth.len seems to be buggy.

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Gilbert Ramirez <gram@xxxxxxxxxxxxxxx>
Date: Tue, 20 Nov 2001 12:15:18 -0600
On Tue, 20 Nov 2001 12:11:07 Daniel Shane wrote:
> Hi all,
>
> 
> Machine2# tethereal -R "eth.dst == 00:00:0c:53:43:2b and eth.len > 1"
> device eth0 entering promis. mode
> Capturing eth0
> <nothing>
> 
> Humm... I dare to say that just about 99.999% (even 100% maybe?) of
> ethernet
> packets should have len > 1?
> 
> Is this normal?
>

"eth.len" does not refer to the "length of the ethernet header" nor
the "length of the ethernet payload", but the "length" field in an ethernet
header. If the encapsulation is "Ethernet II", then there is no "length"
field.
That's why the filter would fail.

If you really want to filter on frame length, use "frame.pkt_len" (which
is different than "frame.cap_len").

--gilbert