Wireshark-users: [Wireshark-users] Searching for Hex in a pcap file using tshark
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Wes <wes_r@xxxxxxxxx>
Date: Wed, 5 Oct 2011 12:00:47 -0700 (PDT)
Is there an equivalently method of doing an Edit->Find Packet->Hex value in Wireshark with command options in tshark?

I have a packet capture file and I just want to search for 6 hex digits such as a Mac address in order to confirm or deny if it's present. Dumping the text and grepping doesn't always work due to line wraps.

I've tried multiple -R filters, but haven't hit on the right one yet...

Thanks,

Wes