Wireshark mailing list archives

Re: Byte matching

From: Jeff Morriss <jeff.morriss.ws () gmail com>
Date: Tue, 27 May 2014 16:39:36 -0400

On 05/26/14 04:07, Matteo Pelliccia wrote:

Hi to all,
maybe it's a silly question. Is it possibile to know what byte match in
display filter expression? For example if I have a pcap file with some
packet and I run tshark with -Y option I would like to know which bytes
match that expression, is it possibile?

Unfortunately no, not today. There's been some discussion ofhighlighting the field (if not the bytes) in the GUI (there's probably abug requesting that) but this is the first time I've heard of it for tshark.


___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
            mailto:wireshark-dev-request () wireshark org?subject=unsubscribe

Current thread:

Byte matching Matteo Pelliccia (May 26)
- wireshark-only capture format Dmitry Bazhenov (May 26)
  - Re: wireshark-only capture format Michal Labedzki (May 27)
  - Re: wireshark-only capture format Jeff Morriss (May 27)
- Re: Byte matching Jeff Morriss (May 27)
  - Re: Byte matching Matteo Pelliccia (May 28)