Re: [Ethereal-users] display filter for pop3?

[Guy Harris <gharris@xxxxxxxxx>]

Agryppa wrote:

> I only want to see those pop3 transmissions that have some payload in it and 
> see the USER field, too. So I did this in display filter:
>
> pop contains USER and pop contains RETR

That will find a *single TCP segment* that has POP traffic where the POP 
traffic has both "USER" and "RETR".

Is that what you're trying to find?

If not, that won't work.  It will not, for example, find a POP 
*conversation* that contains both a USER command and a RETR command 
("USER" is a command, not a field), unless the USER and RETR command are 
in the *same TCP segment*.  There is nothing in Ethereal's display 
filter mechanism to handle matching conversations rather than individual 
packets.