This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

how to filter by first two octets of data.data

0

Hi,

i want to know how to filter by first two octets of data.data

Example:

I have TCP header with the next data.data: Data: 01:02:06:a1:05:a1:0d:0c:6c...

and i want to display only the next data.data: 01:02:[any:any:any...]

Thanks,

asked 07 Oct '16, 07:23

shlomig's gravatar image

shlomig
11●1●1●3
accept rate: 0%

One Answer:

0

Try data.data[0,1] == 01:02.

answered 07 Oct '16, 08:37

sindy's gravatar image

sindy
6.0k●4●8●51
accept rate: 24%