Wireshark-users: [Wireshark-users] question about fancy DHCP display filtering
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Stefan Puiu <stefan.puiu@xxxxxxxxx>
Date: Tue, 15 May 2007 16:34:12 +0000 (UTC)
Hi, 

I'm using wireshark 0.99.5 to read a *huge* tcpdump capture file and diagnose
some software problems. I need to do some filtering on DHCP, since I've got
around 65.000 DHCP packets in the capture. 

Is it possible (with this wireshark version) to specify a filter along the 
lines of "all packets that carry option x with value y"? 
As far as I can tell, all I can currently specify is "one packet that 
has one option type x and one option with value y", but not the same. 

Example filters I would need: 

- all DHCPDISCOVER packets that carry option 55 (parameter request list) 
with a certain value in the respective option (e.g. 1,3,58,59 being the 
sequence of values)

- all DHCPOFFER/DHCPACK packets without option 3

Thanks in advance,
Stefan.