Re: Searching for Hex in a pcap file using tshark

[Wes <wes_r () yahoo com>]

Nice! Exactly what I needed. 

The colons were what I was missing and then I gave up on 'contains' and went further in the weeds after that!

Thanks,

Wes

--- On Wed, 10/5/11, Stephen Fisher <steve () stephen-fisher com> wrote:

> From: Stephen Fisher <steve () stephen-fisher com>
> Subject: Re: [Wireshark-users] Searching for Hex in a pcap file using tshark
> To: "Community support list for Wireshark" <wireshark-users () wireshark org>
> Date: Wednesday, October 5, 2011, 3:10 PM
> On Wed, Oct 05, 2011 at 12:00:47PM
> -0700, Wes wrote:
>
> > Is there an equivalently method of doing an
> Edit->Find Packet->Hex 
> > value in Wireshark with command options in tshark?
>
> > I've tried multiple -R filters, but haven't hit on the
> right one 
> > yet...
>
> Try -R "frame contains xx:xx" (each hex byte is represented
> by xx and 
> you can have more if needed).
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>          
>    mailto:wireshark-users-request () wireshark org?subject=unsubscribe
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe