This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Offset range display filter

0

Can I write a display filter that will look at offset "X" for a range of values (i.e from a000 to a800).

asked 25 Jun '14, 07:27

pcove's gravatar image

pcove
1●1●1●1
accept rate: 0%

One Answer:

0

This filter would display packets within your range at offset 0 in the data portion

data[0:2] ge a0:00 and data[0:2] le  a8:00

Hope this helps

answered 25 Jun '14, 14:30

mrEEde's gravatar image

mrEEde
3.9k●15●22●70
accept rate: 20%