Wireshark · Ethereal-users: Re: [Ethereal-users] display filter for ARP

["jspaar" <jspaar@xxxxxxxxxxxxx>]

----- Original Message -----
From: "Guy Harris" <gharris@xxxxxxxxxxxx>
To: "Gilbert Ramirez" <gram@xxxxxxxxxx>
Cc: "jspaar" <jspaar@xxxxxxxxxxxxx>; <ethereal-users@xxxxxxxxxxxx>
Sent: Saturday, January 13, 2001 7:15 PM
Subject: Re: [Ethereal-users] display filter for ARP


> On Sat, Jan 13, 2001 at 08:23:56PM -0600, Gilbert Ramirez wrote:
> > arp.src.proto == ww:xx:yy:zz
> >
> > would work.
>
> Nope, if you do
>
> arp.src.proto == 10:120:4:178
>
> the parser says
>
> "10:120:4:178" is not a valid number.
>
>

But Gilbert was close.  It does work if I say:
arp.src.proto[0] == ww:xx:yy:zz


Note that the "[0]" is required AND that ww, xx, yy, and zz must be in
hex.
I guess it's normal behaviour that the byte array type always requires
an [offset]?

Maybe a wishlist item would be the ability to make a cast like:
    (IPv4)arp.src.proto
Or that comparisons of a byte array to a fixed-length type would cause
a promotion.

Anyway, thanks!

++Jack