Wireshark-users: Re: [Wireshark-users] question about fancy DHCP display filtering

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Sake Blok <sake@xxxxxxxxxx>
Date: Tue, 15 May 2007 19:30:26 +0200
On Tue, May 15, 2007 at 06:23:41AM -1100, Hans Nilsson wrote:
> Coudln't he use slices? Something like "frame[30-33] == 1:3:58:59" (in
> hex really but) or what fits his purposes.

The DHCP options might not be in the same order in every frame and also
some variable length fields might be in the frame *before* the option
you want to filter on. That would mess up the addresses in the frame[x-y]
filter.

Cheers,


Sake