Wireshark · Wireshark-users: Re: [Wireshark-users] question about fancy DHCP display filtering

[Stefan Puiu <stefan.puiu@xxxxxxxxx>]

Guy Harris <guy@...> writes:
> Unfortunately, not in general - the BOOTP/DHCP dissector doesn't have 
> separate named fields for the values of all options it knows about.

Thanks for confirming that. Then I've another question: how can I look
for all DHCP packets where there is an option with value '0x3058' (in
hex), for example? I can't seem to grasp how the "bootp.options.value
== " filter is supposed to work - I've tried:

* "bootp.options.value == 0x3058" (field turns red, invalid format)
* "bootp.options.value == 30 58" (field turns green, however, all
packets are matched, even if that is not correct)

This would at least in my particular situation - I'm trying to find some DHCP 
clients which send some bogus options. 

Thanks,
Stefan.