Wireshark · Wireshark-users: Re: [Wireshark-users] bitwise operating gives syntax error. + displaying a slice.

[Jaap Keuter <jaap.keuter@xxxxxxxxx>]

Hi,

Are you trying capture or display filters here?

The capture file expression part "ip[0] & 0" would always yield 0.

Thanks,
Jaap

On 04/08/2012 05:37 PM, Marilo wrote:
> I am having trouble trying to get the bitwise operator to function here without a syntax error
>
> This works
>
> C:\sdf>tshark -r asdf2 "ip[0]==45"
>
> but when I put a bitwise AND in there, I get a syntax error
>
> C:\sdf>tshark -r asdf2 "ip[0]&0==45"
> tshark: Syntax error.
>    Note: That display filter code looks like a valid capture filter;
>          maybe you mixed them up?
>
> C:\sdf>
>
>
> Also where in the manual does it speak about this?
>
> And it'd be really useful in debugging a filter, if I could display, say, ip[0] or  ip[0]<<2
> Is that possible and is it possible to only display ip[0] or tcp[12] or whatever slice, of a packet?