Under version v1.12.2 a filter on data.text (ex : "data.text contains "welc"") is not working but under v1.10.6 it works. Is there a configuration I'm missing? Is it confimed? Is it extended to other filters? Thanks asked 09 Dec '14, 06:28  Reynald |
2 Answers:
Check the preferences for the "data" dissector. To use the data.text field as a filter you must enable the preference "Show data as text". answered 09 Dec '14, 06:36  grahamb ♦ |
I don't know why it works with 1.10.x and not with 1.12.x. Can you provide a sample capture file that shows the effect? BTW: can you please try the following as a workaround?
The false positives should be low enough to for an acceptable workaround. Regards answered 09 Dec '14, 06:37  Kurt Knochner ♦ |
Thanks a lot grahamb. This works. Do you have an explanation about why "data.text" is not looking inside the data as text ? and then we have to enable this parameter...
The dissector is (currently) written that way. Unless the preference is enabled, the dissector does not add the data.text field when dissecting the data.
I guess it's an optimization of some form.