Wireshark-bugs: [Wireshark-bugs] [Bug 8084] The display filter "tcp.data contains ff:ff:ff:ff" d

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Wed, 19 Dec 2012 16:06:21 +0000

Comment # 2 on bug 8084 from 
This happens because the TCP dissector hands off the data to the "data"
dissector in this case.  Therefore, "tcp contains ff:ff:ff:ff" works as does
"data contains ff:ff:ff:ff" (or even "data.data contains ff:ff:ff:ff"), but
"tcp.data contains ff:ff:ff:ff" does not.

A lot of protocols hand off undissected data to the "data" dissector, so I
think this issue applies to more than just the TCP dissector.

You are receiving this mail because:
  • You are watching all bug changes.