Re: Searching for Hex in a pcap file using tshark

[Stephen Fisher <steve () stephen-fisher com>]

On Wed, Oct 05, 2011 at 12:00:47PM -0700, Wes wrote:

> Is there an equivalently method of doing an Edit->Find Packet->Hex 
> value in Wireshark with command options in tshark?

> I've tried multiple -R filters, but haven't hit on the right one 
> yet...

Try -R "frame contains xx:xx" (each hex byte is represented by xx and 
you can have more if needed).
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe