Wireshark-users: [Wireshark-users] bitwise operating gives syntax error. + displaying a slice.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Marilo <narium85-mlscar@xxxxxxxxxxx>
Date: Sun, 8 Apr 2012 16:37:38 +0100 (BST)
I am having trouble trying to get the bitwise operator to function here without a syntax error

This works

C:\sdf>tshark -r asdf2 "ip[0]==45"

but when I put a bitwise AND in there, I get a syntax error

C:\sdf>tshark -r asdf2 "ip[0]&0==45"
tshark: Syntax error.
  Note: That display filter code looks like a valid capture filter;
        maybe you mixed them up?

C:\sdf>


Also where in the manual does it speak about this? 

And it'd be really useful in debugging a filter, if I could display, say, ip[0] or  ip[0]<<2
Is that possible and is it possible to only display ip[0] or tcp[12] or whatever slice, of a packet?