Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 8084] The display filter "tcp.data contains ff:ff:ff:ff" doesn't work, but "tc

Wireshark-bugs: [Wireshark-bugs] [Bug 8084] The display filter "tcp.data contains ff:ff:ff:ff" d

Date: Wed, 19 Dec 2012 16:06:21 +0000

Comment # 2 on bug 8084 from Chris Maynard

This happens because the TCP dissector hands off the data to the "data"
dissector in this case.  Therefore, "tcp contains ff:ff:ff:ff" works as does
"data contains ff:ff:ff:ff" (or even "data.data contains ff:ff:ff:ff"), but
"tcp.data contains ff:ff:ff:ff" does not.

A lot of protocols hand off undissected data to the "data" dissector, so I
think this issue applies to more than just the TCP dissector.

You are receiving this mail because:

You are watching all bug changes.

References:
- [Wireshark-bugs] [Bug 8084] New: the display filter "tcp.data contains ff:ff:ff:ff:00:08" can't work
  - From: bugzilla-daemon

Prev by Date: [Wireshark-bugs] [Bug 8104] Some thing may wrong with the amount of data in ICMP packet
Next by Date: [Wireshark-bugs] [Bug 8089] New Dissector - SEL (Schweitzer Engineering Laboratories) Fast Message
Previous by thread: [Wireshark-bugs] [Bug 8084] The display filter "tcp.data contains ff:ff:ff:ff" doesn't work, but "tcp contains ff:ff:ff:ff" does
Next by thread: [Wireshark-bugs] [Bug 8084] The display filter "tcp.data contains ff:ff:ff:ff" doesn't work, but "tcp contains ff:ff:ff:ff" does
Index(es):
- Date
- Thread