Wireshark-users: Re: [Wireshark-users] question about fancy DHCP display filtering

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 15 May 2007 10:30:16 -0700
Hans Nilsson wrote:

Coudln't he use slices? Something like "frame[30-33] == 1:3:58:59" (in
hex really but) or what fits his purposes.
He could, if he knows the *exact* offset from the beginning of the BOOTP/DHCP packet of the field in question.
That assumes, of course, that it *has* an exact offset. The offset of a given option depends on what options are in the packet before the option you're checking, so it might be different in different packets.