[Alex Lee <Alex.Lee@xxxxxxxxxxxx>]

Can Wireshark perform byte offset matches like tcpdump does? For example, if I’m looking for something in the tcp options field, in tcpdump, to match against a hex value in that port of the tcp field, I’d do something like this:

 

# tcpdump …………. tcp[33:2]=0x4e10

 

If the captures are already taken in the WS cap format, is there a way I can use the _expression_ above? It seems like this isn’t the case but I thought I’d ask.

Alex Lee