[Guy Harris <gharris@xxxxxxxxx>]

Dabasinskas, Martynas wrote:

> Question: is it possible to set some capture filter to capture only 
> these packets with 123 inside ?

No.  The capabilities of libpcap capture filters are limited (they 
don't, for example, include loops, as the filter is, on some platforms, 
loaded into the OS kernel, so that packets that don't match the filter 
can be discarded without being copied to user space; disallowing loops 
simplifies the task of making sure the BPF program into which the filter 
expression is compiled won't cause problems, as disallowing loops means 
disallowing infinite loops).

You might be able to do it with Tethereal by using a read filter of 
"frame contains 123".