Ethereal-dev: Re: [Ethereal-dev] Filtering by a calculated field

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "S. Faizi" <sfaizi@xxxxxxx>
Date: Fri, 4 Mar 2005 06:17:54 -0700
Title: Message
You may be able to do this with a hidden field. As you process each packet, set a hidden field and then later filter on it.
----- Original Message -----
Sent: Thursday, March 03, 2005 5:00 PM
Subject: [Ethereal-dev] Filtering by a calculated field

Hi,
 
This is a question related to filtering by a calculated field (field that is not present in the frame but can be calculated from fields that are present).
 
Let's say our protocol consists of messages
    A(MAC address, ID, other fields),
    B(MAC address, other fields) and
    C(MAC address, other fields).
 
Only message A contains ID field. Once we receive message A we store association of (MAC address, ID). If we receive message B or C we will try to find (MAC address, ID) association using MAC address as a key, and if found ID can be displayed for messages B and C. Is there a way to also filter messages B and C by ID, if ID is not present but can be calculated?
 
Thank you,
Alex Filonenko
 
 
 

_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev