Wireshark · Ethereal-users: RE: [Ethereal-users] Find Frame / Filtering

["Visser, Martin (Sydney)" <Martin.Visser@xxxxxx>]

Oh I see now, you want to search for the string. (The 0: range indicated
to me that you were trying to match the string at offset 0). If you need
to search for an ascii string you may want to try "tethereal -V -r
your_capture_file | grep the_string". (Or even just "strings
your_capture_file | grep the_string" though this won't tell you which
frame the string is in)

Martin Visser
Network Consultant - Global Services
COMPAQ, part of the new HP

3 Richardson Place
North Ryde, Sydney NSW 2113, Australia
Phone *: +61-2-9022-1670    Mobile *: +61-411-254-513
   Fax 7: +61-2-9022-1800     E-mail * : martin.visser@xxxxxx




-----Original Message-----
From: Evers, John E. [mailto:JEVERS@xxxxxxx] 
Sent: Tuesday, 27 August 2002 11:15 PM
To: Visser, Martin (Sydney); ethereal-users@xxxxxxxxxxxx
Cc: Evers, John E.
Subject: RE: [Ethereal-users] Find Frame / Filtering


Martin,

Thanks for the reply

I've tried on this on both 0.95 and 0.9.6 WIN32 with the same results.

As I don't know the offset in the payload hex data stream I cannot use
the workaround.  I search for file names, values being read from a
database file and database error codes.  The application I support, as a
customer support person not a programmer, does not do the best job of
interpreting error codes so I use network traces to determine the actual
cause of failures.

Thanks again,
John



		-----Original Message-----
		From:	Visser, Martin (Sydney)
[mailto:Martin.Visser@xxxxxx]
		Sent:	Monday, August 26, 2002 6:21 PM
		To:	ethereal-users@xxxxxxxxxxxx
		Cc:	Evers, John E.
		Subject:	RE: [Ethereal-users] Find Frame /
Filtering

		You're right, there is something broken (at least in
0.9.3
on win32).
		However there is a workaround that may work for you. 
		For the bug fixers the following two examples DO match
packets correctly
		:-

		ipx[0:2] == "ff:ff"
		ipx[0:8] == "ff:ff:00:72:03:11:0a:8f"
		ipx[0] == "ff" && ipx [1] == "ff"

		But the following DON'T match

		ipx[0:] == "ff:ff"
		ipx[0:1] == "ff:ff"
		ipx[0:42] == "ff:ff"


		It seems that an open ended range or a range that
doesn't exactly match
		the number of bytes in the match string doesn't work.

		-----Original Message-----
		From: Evers, John E. [mailto:JEVERS@xxxxxxx] 
		Sent: Tuesday, 27 August 2002 7:44 AM
		To: ethereal-users@xxxxxxxxxxxx
		Subject: [Ethereal-users] Find Frame / Filtering


		Hi,

		I do a lot of tracing which requires searching /
filtering
on the data
		stream.

		I have tried the "Find Frame" and "Filtering" options
with the following
		parameters.  

		smb[0:] == 43:00:6f:00:6d:00:6d:00:    ;I copied the hex
data stream
		from
		the hex data of a trace.
		ip[0:] == 43:00:6f:00:6d:00:6d:00:    ;I copied the hex
data
stream from
		the
		hex data of a trace.
		tcp[0:] == 43:00:6f:00:6d:00:6d:00:    ;I copied the hex
data stream
		from
		the hex data of a trace.
		data[0:] == 43:00:6f:00:6d:00:6d:00:    ;I copied the
hex
data stream
		from
		the hex data of a trace.

		I've have also tried to search for hex streams that were
not separated
		by the 00 hex characters as in the above example, same
results.


		Applying as a Filter displays no results and Find Frame
responds with a
		"No Packet Matched Filter" message.  

		I am guessing Ethereal dose not support this, but as it
is important to
		me I want to make sure before I abandon it for this
application.

		Thanks for any feed back.

		John


	
************************************************************************
		**** 
		This email may contain confidential material. 
		If you were not an intended recipient, 
		Please notify the sender and delete all copies. 
		We may monitor email to and from our network. 
	
************************************************************************
		****
		_______________________________________________
		Ethereal-users mailing list
		Ethereal-users@xxxxxxxxxxxx
		http://www.ethereal.com/mailman/listinfo/ethereal-users

************************************************************************
**** 
This email may contain confidential material. 
If you were not an intended recipient, 
Please notify the sender and delete all copies. 
We may monitor email to and from our network. 
************************************************************************
****