I have a pcap file and want to print x number of bytes starting at offset i in the packet. I can specify a filter which will match the frames based on the content of those bytes, for instance, frame[i:x] == b2f5... , but I cannot figure out how to actually print those bytes. I tried "-T fields -e frame[i:x]" but that does not print anything. asked 08 Mar '12, 12:13 nixbox |