Re: Wireshark Capture Filter Using Offset

[Guy Harris <guy () alum mit edu>]

On Jul 19, 2010, at 9:32 PM, j.snelders wrote:

> I think  the capture filter should be (but can't test it right now):
> dns[2:2]==0x2800

libpcap doesn't know about DNS, so that doesn't work.
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe