Wireshark-users: Re: [Wireshark-users] Display Filter for text string in TCP payload

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Sake Blok <sake@xxxxxxxxxx>
Date: Tue, 8 Apr 2008 23:02:35 +0200
On Tue, Apr 08, 2008 at 10:39:44PM +0200, Luis EG Ontanon wrote:
> On Tue, Apr 8, 2008 at 10:28 PM, Feeny, Michael (GWM-CAI)
> <michael_feeny@xxxxxx> wrote:
> >
> > I would like to filter on all TCP packets that have a particular text string
> > in the payload of the packet.  I tried doing this by saying???
> >
> >         tcp.segment contains "sometext"
> >
> > Or simply???
> >
> >         tcp contains "sometext"
> >
> > ??? but neither approach worked.
>
> what about
> frame contains "abcde"
> does that do?

Hmmm... 'tcp contains "PASS"' does display the packets with
the FTP pass command in my trace. I'm wondering why it does
not work for you?

Cheers,
    Sake