Wireshark-users: Re: [Wireshark-users] Filter for DNS tcp flags?

From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Thu, 09 Apr 2009 20:26:21 +0200

Hi,

You're confused. It's dns.flags what you're looking for.
In fact "dns.flags.rcode == 3" is what you want to use as display filter.

Thanx,
Jaap

Scott Baker wrote:

I want to filter out all DNS queries that fail with a "no such name"
response. As far as I can tell that's tcp flag 0x8583, but I don't
know how to filter for that. The docs say tcp.flags is an 8 bit field,
so it can't be 0x8583. How do I filter DNS for specific flags?

- Scott