Wireshark-users: Re: [Wireshark-users] specifying > 4 byte offsets / capture filters
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Stuart Kendrick <skendric@xxxxxxxxx>
Date: Mon, 08 Oct 2012 10:58:38 -0700


Correct.  For filter tests, it currently only generates BPF code where the data can be tested with a single comparison instruction, which means no more than 4 bytes (the BPF pseudo-machine is a 32-bit machine).


Can anyone think of a creative way to do the same thing?


arp and ((ether[22:4]==0x001e4f3d and ether[26:2]==0x4204) or (ether[32:4]==0x001e4f3d) and ether[36:2]==0x4204))


Ahh.  Thank you Guy,

--sk