I need help to parser a doc xml. I need to get the value of @show, but only on the lines with @name="wlan.seq". And after, I need to know how many times the same value of @show was repeated in the doc xml (if it was repeated). How do i do that? Is there anybody that can help me please?

<pdml version="0" creator="wireshark/1.0.6" >
<field name="wlan.duration" showname="Duration: 44" size="2" pos="2" show="44" value="2c00" />
<field name="wlan.da" showname="Destination address: AtherosC_0b:aa:75 (00:03:7f:0b:aa:75)" size="6" pos="4" show="00:03:7f:0b:aa:75" value="00037f0baa75" />
<field name="wlan.bssid" showname="BSS Id: AlphaNet_14:9e:91 (00:1d:6a:14:9e:91)" size="6" pos="10" show="00:1d:6a:14:9e:91" value="001d6a149e91" />
<field name="wlan.sa" showname="Source address: D-Link_ed:35:2c (00:1c:f0:ed:35:2c)" size="6" pos="16" show="00:1c:f0:ed:35:2c" value="001cf0ed352c" />
<field name="wlan.frag" showname="Fragment number: 0" size="2" pos="22" show="0" value="20aa" />
<field name="wlan.seq" showname="Sequence number: 2722" size="2" pos="22" show="2722" value="20aa" />
<field name="wlan.addr" showname="Source or Destination address: AtherosC_0b:aa:75 (00:03:7f:0b:aa:75)" hide="yes" size="6" pos="4" show="00:03:7f:0b:aa:75" value="00037f0baa75" />
<field name="wlan.addr" showname="Source or Destination address: D-Link_ed:35:2c (00:1c:f0:ed:35:2c)" hide="yes" size="6" pos="16" show="00:1c:f0:ed:35:2c" value="001cf0ed352c" />
<field name="" show="QoS Control" size="2" pos="24" value="0000" >
<field name="wlan.qos.priority" showname="Priority: 0 (Best Effort) (Best Effort)" size="1" pos="24" show="0" value="00" />
<field name="wlan.qos.eosp" showname="...0 .... = EOSP: Service period" size="1" pos="24" show="0" value="0" unmaskedvalue="00" />
<field name="wlan.qos.ack" showname="Ack Policy: Normal Ack (0x00)" size="1" pos="24" show="0x00" value="00" />
<field name="wlan.qos.amsdupresent" showname="Payload Type: MSDU" size="1" pos="24" show="0" value="00" />
<field name="" show="QAP PS Buffer State: 0x0" size="1" pos="25" value="00" />


Your question is somewhat vague. Using your example, do you want a count of all instances of "2722", i.e. 2, or just the instances where show=2722, i.e. 1, or what?

This article has been dead for over six months. Start a new discussion instead.