Wireshark-users: [Wireshark-users] Can Wireshark to byte offset matching
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Alex Lee <Alex.Lee@xxxxxxxxxxxx>
Date: Fri, 8 Aug 2008 10:02:56 -0700

Can Wireshark perform byte offset matches like tcpdump does? For example, if I’m looking for something in the tcp options field, in tcpdump, to match against a hex value in that port of the tcp field, I’d do something like this:

 

# tcpdump …………. tcp[33:2]=0x4e10

 

If the captures are already taken in the WS cap format, is there a way I can use the _expression_ above? It seems like this isn’t the case but I thought I’d ask.


Alex Lee