Wireshark · Ethereal-dev: Re: [ethereal-dev] Match Selected...

[John McDermott <jjm@xxxxxxxxxx>]

Laurent Deniel wrote:
> 
> John McDermott wrote:
> >
> > >
> > > Making it work with the hex dump window would be nice.
> > >
> > So would if four bytes were selected, would it look at those four bytes
> > *anywhere* in a frame, or just at the same offset?
> >
> 
> Just at the same offset. This is particularly useful for bytes in the
> undecoded data portion (you can not partially select in the protocol
> tree window).
I can see the use.  The problem is that the data field may begin at
different offsets (due, for example to TCP or IP options) thus causing
one to miss some packets.  This might confuse some users.  For the case
of searching for data, maybe a search could be smart enough (in an ideal
world) to check at the offset from the data portion.  This is possibly a
different search than searching the hex dump, though.

--john

-- 
John McDermott, Writer and Consultant
J-K International, Ltd.
V +1 505/377-6293  F +1 505/377-6313
jjm@xxxxxxxxxx