Display Filter - Byte Offset Notation
"Prigge Scott" <[email protected]> Wed, 23 Aug 2006 13:08:12 -0500
| Newsgroups | gmane.network.ethereal.user |
|---|---|
| Message-ID | <[email protected]> |
------------------- The Ethereal project is being continued at a new site. Please go to http://www.wireshark.org and subscribe to [email protected]. Don't forget to unsubscribe from this list at http://www.ethereal.com/mailman/listinfo/ethereal-users ------------------- Using version 0.99.0, and am struggling to create a simple display filter using byte offset notation. I want to simply capture traffic where the first two bytes of the source address are 68.154. Shouldn't this filter be as simple as ip[12:2]==68 154? I've tried lots of different permutations, but can't get any to work. I have created the same offset filter in another product, Network Instruments Observer, and I get the results I would expect.