Wireshark · Wireshark-users: Re: [Wireshark-users] Searching for Hex in a pcap file using tshark

[Wes <wes_r@xxxxxxxxx>]

Nice! Exactly what I needed. 

The colons were what I was missing and then I gave up on 'contains' and went further in the weeds after that!

Thanks,

Wes

--- On Wed, 10/5/11, Stephen Fisher <steve@xxxxxxxxxxxxxxxxxx> wrote:

> From: Stephen Fisher <steve@xxxxxxxxxxxxxxxxxx>
> Subject: Re: [Wireshark-users] Searching for Hex in a pcap file using tshark
> To: "Community support list for Wireshark" <wireshark-users@xxxxxxxxxxxxx>
> Date: Wednesday, October 5, 2011, 3:10 PM
> On Wed, Oct 05, 2011 at 12:00:47PM
> -0700, Wes wrote:
> 
> > Is there an equivalently method of doing an
> Edit->Find Packet->Hex 
> > value in Wireshark with command options in tshark?
> 
> > I've tried multiple -R filters, but haven't hit on the
> right one 
> > yet...
> 
> Try -R "frame contains xx:xx" (each hex byte is represented
> by xx and 
> you can have more if needed).
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>          
>    mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
>