Ethereal-users: Re: [Ethereal-users] Help

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Sun, 25 Nov 2001 13:50:35 -0800
On Sun, Nov 25, 2001 at 06:24:00AM -0500, Tom wrote:
> I want to capture only tcp-udp traffic that has X-MMS-IM which occurs
> in MS Instant Messenger traffic.
> 
> How do I set this up?

If you mean you only want to capture TCP or UDP traffic that contains
the string "X-MMS-IM" in it, the question should have been asked as "how
can I set this up?", so that the correct answer - "you can't" - would
match the syntax of the question.

Capture filters have limited capabilities (they're compiled into an
interpreted machine language and, on many platforms, that machine
language is interpreted in the OS kernel, so, for safety reasons, it
*has* to be a fairly simple and limited language), and those
capabilities do not include the ability to search for arbitrary strings
in packet contents.