Wireshark-dev: Re: [Wireshark-dev] filter packets
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 15 May 2013 15:54:37 -0700
On May 15, 2013, at 3:19 PM, Ahmed Elshaer <a.n.elshaer@xxxxxxxxx> wrote:

> can i filter packets that contains a specific text string , i just
> want to capture the packets that contain that string not any other
> string,

Unfortunately, the filtering that can be done with BPF (which is what tcpdump and Wireshark use for capture filtering) is limited in what it can do (by design - it's done by running an interpreted or JIT-compiled program in the kernel, and, to prevent infinite loops being run in the kernel, loops are not allowed, and there is no "search for a string" instruction).