Ethereal-users: Re: [Ethereal-users] Filter fragmented packets

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev
From: "Mark C. Brown" <mbrown@xxxxxxxxxx>
Date: Sat, 30 Oct 2004 12:45:40 -0400
On Sat, 2004-10-30 at 11:49, Suja Prabha wrote:
> Can someone tell me how to filter out the fragmented packets from the
> data that I have captured?

ip.frag_offset==0

This will give you all first fragments and non-fragments.

If you only want first fragments:

ip.flags.mf==1 && ip.frag_offset==0

-- 
"If a train station is where a train stops, | Mark C. Brown
 then what's a workstation?" -- D. Huber    | mbrown@xxxxxxxxxx