Hi, Part of the flow is the source and destination mac address but looks like mate isnt capable to extract eth.addr , can it be configured ? Sample which i tried: Pdu icmp_pdu Proto icmp Transport ip {
}; Gop icmp_ses On icmp_pdu Match (addr, addr, source_addr, source_addr) {
}; Done; asked 09 May '11, 00:45 okochva edited 09 May '11, 01:37 |
One Answer:
My suggestion would be to use eth.src and ip.src instead. answered 09 May '11, 06:00 Jaap ♦ |