Ethereal-dev: Re: [Ethereal-dev] Colour filter issue

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxx>
Date: Thu, 8 Aug 2002 12:07:10 -0700
On Thu, Aug 08, 2002 at 11:37:29AM -0500, Neulinger, Nathan wrote:
> Is their only 1 status fields in the frames that you are dissecting?
> 
> Thing to keep in mind is that your query below is not the same...
> 
> Example:
> 	Frame 1: status=0, status=1
> 	Frame 2: status=2
> 	Frame 3: status=1, status=2
> 
> If you use "status != 2 && status != 0", all three frames will match.
> 
> But if you use "status == 1", only 1 and 3 will match.
> 
> Without knowing the particulars of the packet you're looking at, I
> couldn't say. (Some protocols/ops result in multiple operations and
> success/failure responses coming back in a single frame.)

NFS-over-TCP can result in multiple operations and success/failure
responses coming back in a single frame; Mike, is this NFS-over-TCP, and
are the cases where

	nfs.status != 0 && nfs.status != 2

is finding frames containing an NFS reply with an "nfs.status" of 2
cases where there are multiple NFS replies in the same frame, where, for
example, one reply has "nfs.status" of 2 (which matches "nfs.status != 0")
and another reply has an "nfs.status" other than 2 (which matches
"nfs.status != 2")?