Wireshark · Wireshark-users: Re: [Wireshark-users] Display filter based on offset, hex

[Abhik Sarkar <sarkar.abhik@xxxxxxxxx>]

Something like this:

frame[0x38:4]==74:72:61:70

On Wed, Jul 8, 2009 at 7:44 PM, Hague, Raymond [IDR] <ray.hague@xxxxxxxx> wrote:

I am attempting to create a display filter but some how keep missing the mark.  I would like to create a filter that would read:

 

Beginning byte=               0038

Length=                               4

Data="" 74:72:61:70

 

Simple enough, right?

 

Can anyone please lend a hand?

 

-Ray

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe