Ethereal-users: RE: [Ethereal-users] Display Filter on Hex in Data Window

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Biot Olivier <Olivier.Biot@xxxxxxxxxxx>
Date: Fri, 16 Apr 2004 16:36:54 +0200
Try the "matches" operator (operates with Perl-compatible regular
expressions):

	icmp matches "\xaa"

Should do the job.

More information on Perl regular expressions can be found on:
http://www.perldoc.com/perl5.8.0/pod/perlre.html

Regards,

Olivier
-----Original Message-----
From: Keith French

I want to build a display filter for some particular hex data e.g. the Hex
aa that is often seen in ICMP pings being used by some RPC worms trying to
find a machine to infect.

Can I use the "contains" relation something along the lines of:-

icmp contains "aa"

but make the value to be hex aa?

Keith French