Ethereal-dev: Re: [Ethereal-dev] Bug in ethereal filtering on DF (Don't Fragment) flag?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Wed, 30 Mar 2005 23:13:16 -0800
ronnie sahlberg wrote:

the filter   "ip.flags.df"   will check if the field DF exists in the
packet or not, regardless of what value it has (i.e. if it is SET or
CLEAR).
It will essentially find all IP packets  since every IP packet has a
DF flag (which is either SET or CLEAR).


...and if you want to check whether it's *set*, you do:

	ip.flags.df == 1

or, to check whether it's *clear*:

	ip.flags.df == 0
I.e., even for Boolean variables, you have to test with == to test the value; the name of a field, by itself, tests whether the field is present or not, not whether, if it's Boolean, it's set.