diff options
| author | Gerald Combs <gerald@wireshark.org> | 1999-09-16 01:24:01 +0000 |
|---|---|---|
| committer | Gerald Combs <gerald@wireshark.org> | 1999-09-16 01:24:01 +0000 |
| commit | 182b9f5fe4f0e43506b2ff7aac17e412d019868a (patch) | |
| tree | 167d5cbc9d1a39c2423ff6ac9e405dc027b9c794 | |
| parent | ec376ff57f1869dd6f1ee1a366a48bee2adb943c (diff) | |
Derek W Poon <dpoon@uclink.berkeley.edu> pointed out that two examples listed
"ether.src" instead of "eth.src". Fixed.
svn path=/trunk/; revision=682
| -rw-r--r-- | doc/ethereal.pod.template | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/doc/ethereal.pod.template b/doc/ethereal.pod.template index e7ae94cfc0..36ddcb58c4 100644 --- a/doc/ethereal.pod.template +++ b/doc/ethereal.pod.template @@ -466,7 +466,7 @@ digits may be separated by colons, periods, or hyphens: fddi.dst eq ff:ff:ff:ff:ff:ff ipx.srcnode == 0.0.0.0.0.1 - ether.src == aa-aa-aa-aa-aa-aa + eth.src == aa-aa-aa-aa-aa-aa If a string of bytes contains only one byte, then it is represented as an unsigned integer. That is, if you are testing for hex value 'ff' in a one-byte byte-string, you must compare @@ -486,7 +486,7 @@ A substring operator also exists. You can check the substring (byte-string) of a or field. For example, you can filter on the vendor portion of an ethernet address (the first three bytes) like this: - ether.src[0:3] == 00:00:83 + eth.src[0:3] == 00:00:83 You can use the substring operator on a protocol name, too. And remember, the "frame" protocol encompasses the entire packet, allowing you to look at the nth byte of a packet regardless |