Field name
Description
Type
eth
Ethernet
No value (only supports checking if file exists or not)
eth.dst
Destination
Ethernet MAC Address
eth.src
Source
eth.type
Ethertype
Signed/Unsigned Integer Value
eth.length
Length
Unsigned Integer, 2 byte
eth.lg
LG Bit
eth.ig
IG Bit
eth.padding
Padding
eth.padding.bytes
Padding Bytes
String of hexadecimal bytes
ethernet_byte_segment
Variable Value