Wireshark-users: Re: [Wireshark-users] Searching for a particular sequence in a packet
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Stephen Fisher <steve@xxxxxxxxxxxxxxxxxx>
Date: Fri, 25 Sep 2009 14:53:30 -0600

On Sep 25, 2009, at 12:06 AM, Hussain wrote:
Also I was just wondering it was possible to search with offsets. For example, I want to search for packets where the first byte is let's say \xe3 (HEX), and then after four bytes, I get the string \x45 (HEX value). I.e. one such possible sequence could be, e3 09 08 ff f3 45. 

This page should help with display filters:

  http://www.wireshark.org/docs/wsug_html_chunked/ChWorkBuildDisplayFilterSection.html