Wireshark · Ethereal-users: RE: [Ethereal-users] searching capture file for text

[Richard Urwin <RUrwin@xxxxxxxxxxxxx>]

"print" the capture to a text file with full details enabled. Search the text file for your string. Find the packet of interest and then refer to that packet in Ethereal.

 

There is no search-at-unknown-offset facility in Ethereal.

--
Richard Urwin, Private
"No 9000 series computer has ever made a mitsake or corrubiteddatatato."
 

-----Original Message-----
From: John Zeiger [mailto:johnz@xxxxxxxxx]
Sent: Friday, July 19, 2002 4:27 AM
To: ethereal-users@xxxxxxxxxxxx
Subject: [Ethereal-users] searching capture file for text

I have a fairly large capture file with http requests from a large number of users. I'm trying to debug a problem where a particular cookie is missing from the http get request.  Unfortunately, the cookie is not a a fixed offset from the beginning of the http request. 

Ideally, I'd like to create a display filter that searches for all http get requests where the http request contains (anywhere) a particular string.  (Something like "http.request eq 1 and http[?] eq 'xyz'").  I've read the documentation a couple of times, but I can figure out how to do this.  Can anybody help?

 

If you can't do it with a display filter, can anyone suggest an alternative?

________________________________________________________________________
This email has been scanned for all viruses by the MessageLabs SkyScan
service. For more information on a proactive anti-virus service working
around the clock, around the globe, visit http://www.messagelabs.com
________________________________________________________________________