Wireshark-users: Re: [Wireshark-users] Display filter

From: Gerald Combs <gerald@xxxxxxxxxxxxx>
Date: Wed, 02 May 2007 11:56:18 -0700

Irakli Natshvlishvili wrote:
> Question:
> 
> Using display filters is there a way to find if a particular string
> occurs more then once in a packet?
> 
> For example, if there is an UDP packet which has payload "this is one
> 1234 two one test", then filtering via UDP contains "one" will display
> this UDP packet.
> 
> But I want to filter ALL packets, where this particular string occurs
> more then once.
> 
> Any way do do it?

If you have PCRE support compiled in, you can use something like

    udp matches "one.*one"

That translates to "the string 'one' followed by zero or more characters
followed by the string 'one'."  The "matches" operator supports
Perl-compatible regular expressions, which are described at
http://perldoc.perl.org/perlre.html .

You can check for PCRE support via "Help->About Wireshark" or by using
the "-v" command-line flag.  You can also type in the filter above and
see if the display filter entry turns green.