From: Sam Wong [mailto:swong02@xxxxxxxxx]
Sent: Friday, December 07, 2001 12:11 PM
> I'd like to set a display filter to show only those
> packets that have a specific hex byte or byte
> sequence starting at a specific offset in my packet
> payload. How do I do this? I couldn't find it in
> the user guide.
Try this -
frame[offset] == value
or
frame[offset:range] == value:value:value:...
frame[offset-offset2] == value:value:value:...
the values' should be in hex.
You should use "frame" to start from the beginning of
the packet. You can use other fields, i.e. ip or tcp,
if you don't want to start at the beginning of the packet.
Jeff Foster
jfoste@xxxxxxxxxxxx
***
The information in this e-mail is confidential and intended solely for the
individual or entity to whom it is addressed. If you have received this
e-mail in error please notify the sender by return e-mail, delete this
e-mail, and refrain from any disclosure or action based on the information.
****
