On 05/26/14 04:07, Matteo Pelliccia wrote:
Hi to all,
maybe it's a silly question. Is it possibile to know what byte match in
display filter expression? For example if I have a pcap file with some
packet and I run tshark with -Y option I would like to know which bytes
match that expression, is it possibile?
Unfortunately no, not today. There's been some discussion of
highlighting the field (if not the bytes) in the GUI (there's probably a
bug requesting that) but this is the first time I've heard of it for tshark.