Ethereal-users: Re: [Ethereal-users] Display filter for bytes at particular offsets.

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Fri, 13 Jun 2003 00:32:35 -0700
On Thu, Jun 12, 2003 at 03:48:06PM +1000, Fullager, Glenn wrote:
> I try 
> 
>     frame[46-4d] == 8:4:1:2:6:8:5:2 and udp.length > 30
> 
> which usually results in Ethereal crashing with an assertion error.

That's because:

	1) by default, offsets in filter expressions are *decimal*, not
	   *hexadecimal*;

	2) the lexical analyzer didn't catch the extra "d" character in
	   "4d", it just returned a value of "4";

	3) Ethereal didn't check for ranges where the ending offset was
	   less than the starting offset, and that caused a crash.

I've checked in a fix for problem 3) (but have to check in another fix
to allow the starting and ending offsets to be equal).

I'll look at doing something about 2).

You have to do something about 1), namely trying

	frame[0x46-0x4d] == 8:4:1:2:6:8:5:2 and udp.length > 30

to see if *that* works.