CODEWITHSUNDEEP
wireshark
Gergely
Gergely

Reputation: 7525

Layer numbering in Wireshark

The Wireshark Reference Manual says:

6.4.5. The Layer Operator

A field can be restricted to a certain layer in the protocol stack using the layer operator (#), followed by a decimal number:

ip.addr#2 == 192.168.30.40

matches only the inner (second) layer in the packet. Layers use simple stacking semantics and protocol layers are counted sequentially starting from 1. For example, in a packet that contains two IPv4 headers, the outer (first) source address can be matched with "ip.src#1" and the inner (second) source address can be matched with "ip.src#2".

According to an artificial intelligence answer, a packet can have two IP headers if

A packet containing two IP headers is not a standard occurrence in normal network operations; it would be considered an error or malformed packet as an IP packet is designed to have only one IP header at the beginning

What use of this layer numbering can have, other than malformed packets?

Upvotes: 0

Views: 28

Answers (0)

Related Questions