Wireshark-users: Re: [Wireshark-users] packet payload string or hex filter
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Stephen Fisher <stephentfisher@xxxxxxxxx>
Date: Thu, 21 Feb 2008 22:01:48 -0700
On Fri, Feb 22, 2008 at 03:38:23AM +0100, Grzegorz Szczytowski wrote:

> I'm wondering if wireshark support string or hex filier similar to 
> following syntax:
> 
> data.data include or content "blablabla"
> 
> The issue is that the filter should goes over the whole packet to 
> match that string.

This is not currently possible because there is no field that contains 
the contents of the entire frame.  Maybe we should add one under the 
frame dissector?  This leaves you with the find packet search that 
allows hex values or strings.


Steve