Re: [Wireshark-dev] Does a filter expression allow searching with a string of bytes as decimal numbers?
https://www.wireshark.org/docs/man-pages/wireshark-filter.html "Also, this is not allowed for decimal numbers, since they would be confused with hex numbers that are already allowed as byte strings. " On Sun, May 10, 2020 at 5:20 AM Jaap Keuter wrote: > Well, simply entering three digit decimal values in the Wireshark display > filter shows that it’s not a valid byte string, so hex only. > I do agree that this type could be (more clearly) described in the Users > Guide. > > Jaap > > > On 9 May 2020, at 17:12, Richard Sharpe > wrote: > > > > Hi folks, > > > > Suppose you have a field in packet that has been inserted as a byte > string, say: > > > > some-proto.some-field = 0x21 0x32 0x81 > > > > Can I search on "some-proto.some-field == 33:50:129" or does the > > filter expression parser think those numbers between the colons are > > HEX digits? > > > > -- > > Regards, > > Richard Sharpe > > (何以解憂?唯有杜康。--曹操)(传说杜康是酒的发明者) > > ___ > Sent via:Wireshark-dev mailing list > Archives:https://www.wireshark.org/lists/wireshark-dev > Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev > mailto:wireshark-dev-requ...@wireshark.org > ?subject=unsubscribe ___ Sent via:Wireshark-dev mailing list Archives:https://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-requ...@wireshark.org?subject=unsubscribe
Re: [Wireshark-dev] Does a filter expression allow searching with a string of bytes as decimal numbers?
Well, simply entering three digit decimal values in the Wireshark display filter shows that it’s not a valid byte string, so hex only. I do agree that this type could be (more clearly) described in the Users Guide. Jaap > On 9 May 2020, at 17:12, Richard Sharpe wrote: > > Hi folks, > > Suppose you have a field in packet that has been inserted as a byte string, > say: > > some-proto.some-field = 0x21 0x32 0x81 > > Can I search on "some-proto.some-field == 33:50:129" or does the > filter expression parser think those numbers between the colons are > HEX digits? > > -- > Regards, > Richard Sharpe > (何以解憂?唯有杜康。--曹操)(传说杜康是酒的发明者) ___ Sent via:Wireshark-dev mailing list Archives:https://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-requ...@wireshark.org?subject=unsubscribe
[Wireshark-dev] Does a filter expression allow searching with a string of bytes as decimal numbers?
Hi folks, Suppose you have a field in packet that has been inserted as a byte string, say: some-proto.some-field = 0x21 0x32 0x81 Can I search on "some-proto.some-field == 33:50:129" or does the filter expression parser think those numbers between the colons are HEX digits? -- Regards, Richard Sharpe (何以解憂?唯有杜康。--曹操)(传说杜康是酒的发明者) ___ Sent via:Wireshark-dev mailing list Archives:https://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-requ...@wireshark.org?subject=unsubscribe