Wireshark-users: Re: [Wireshark-users] bitwise operating gives syntax error. + displaying a slice

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Mon, 09 Apr 2012 17:50:31 +0200
Hi,

Are you trying capture or display filters here?

The capture file expression part "ip[0] & 0" would always yield 0.

Thanks,
Jaap

On 04/08/2012 05:37 PM, Marilo wrote:

I am having trouble trying to get the bitwise operator to function here without a syntax error

This works

C:\sdf>tshark -r asdf2 "ip[0]==45"

but when I put a bitwise AND in there, I get a syntax error

C:\sdf>tshark -r asdf2 "ip[0]&0==45"
tshark: Syntax error.
   Note: That display filter code looks like a valid capture filter;
         maybe you mixed them up?

C:\sdf>


Also where in the manual does it speak about this?

And it'd be really useful in debugging a filter, if I could display, say, ip[0] or  ip[0]<<2
Is that possible and is it possible to only display ip[0] or tcp[12] or whatever slice, of a packet?