Re: [Ethereal-users] Simple Display Filter Question

[Guy Harris <guy@xxxxxxxxxx>]

> I'm new to Ethereal and I'm trying to perform a search for a hex string
> using my Display filter.  There must be a simple way to do this???

Display filters can only match either

	1) named fields

or

	2) hex values at *specific* offsets

There is no way to say, for example, "match all packets that contain hex
50:41:49:4E no matter where it occurs in the packet".

If that's what you mean by "a search for a hex string", the only way to
do that would be to print the capture to a file, with the "Print hex
data" option turned on, and then search the file, although if the hex
string is split between lines of the printout, it may be difficult to do
that.