["John Zeiger" <johnz@xxxxxxxxx>]

I have a fairly large capture file with http requests from a large number of users. I'm trying to debug a problem where a particular cookie is missing from the http get request.  Unfortunately, the cookie is not a a fixed offset from the beginning of the http request. 

Ideally, I'd like to create a display filter that searches for all http get requests where the http request contains (anywhere) a particular string.  (Something like "http.request eq 1 and http[?] eq 'xyz'").  I've read the documentation a couple of times, but I can figure out how to do this.  Can anybody help?

 

If you can't do it with a display filter, can anyone suggest an alternative?

Attachment: smime.p7s
Description: S/MIME cryptographic signature