Re: Display filter on smb2.fid

[Jeff Morriss <jeff.morriss.ws () gmail com>]

On 12/12/2017 03:33 PM, Rodrigo Borges Pereira wrote:
> Hi,
>
> I'd like to match on partial smb2.fid, for example smb2.fid[0] == 00
>
> But this seems to be an invalid expression. Is there any trick to it, or 
> just not possible at all?

That's not possible with that field.  You can do partial matches on 
fields that are byte arrays, for example:

eth.addr[0:3]==00:06:5B

But GUIDs (such as smb2.fid) aren't treated as byte arrays so it doesn't 
work.
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request () wireshark org?subject=unsubscribe