On Wed, 16 Aug 2000 13:26:05 John McDermott wrote:
>
>
>
> Laurent Deniel wrote:
> >
> > John McDermott wrote:
> > >
> > > >
> > > > Making it work with the hex dump window would be nice.
> > > >
> > > So would if four bytes were selected, would it look at those four bytes
> > > *anywhere* in a frame, or just at the same offset?
> > >
> >
> > Just at the same offset. This is particularly useful for bytes in the
> > undecoded data portion (you can not partially select in the protocol
> > tree window).
> I can see the use. The problem is that the data field may begin at
> different offsets (due, for example to TCP or IP options) thus causing
> one to miss some packets. This might confuse some users. For the case
> of searching for data, maybe a search could be smart enough (in an ideal
> world) to check at the offset from the data portion. This is possibly a
> different search than searching the hex dump, though.
Instead of frame[offset:length], the "match" function could produce something
like tcp[offset:length] or even data[offset:length]
--gilbert