On Fri, Feb 22, 2008 at 03:38:23AM +0100, Grzegorz Szczytowski wrote:
> I'm wondering if wireshark support string or hex filier similar to
> following syntax:
>
> data.data include or content "blablabla"
>
> The issue is that the filter should goes over the whole packet to
> match that string.
This is not currently possible because there is no field that contains
the contents of the entire frame. Maybe we should add one under the
frame dissector? This leaves you with the find packet search that
allows hex values or strings.
Steve