When frame contains Unicode string like "select", it is displayed as "s e l e c t", the space between characters is the null character \x00 not the space.
if i use the display filter:
it is not filtered.
so, I have to convert the string "select" to hex decimal manually , and run the display filter:
and it's working.
Also, I tried to use the find tool (in the tool bar) and picked Wide (UTF-16) and entered "s e l e c t", but it couldn't find the string.
I use wireshark v 2.2.0
asked 15 Sep '16, 13:39
That's Unicode in a UTF-16 encoding, i.e. 2 bytes per code unit.
Leave the character encoding selector set to Narrow & Wide and just enter your string with the required characters, i.e. "select". This will search for both UTF-8/ASCII and UTF-16 encodings of the required string.
If you really want to find just UTF-16 encodings of the string, set the encoding selector to Wide, but still just enter the actual characters required.
answered 16 Sep '16, 02:35