Wireshark-users: Re: [Wireshark-users] Display filter based on offset

From: "Hague, Raymond [IDR]" <ray.hague@xxxxxxxx>
Date: Thu, 9 Jul 2009 07:43:43 -0500

Date: Thu, 9 Jul 2009 10:01:15 +0400
From: Abhik Sarkar <sarkar.abhik@xxxxxxxxx>

That worked.  Thank you.  I'd have never found "frame".   -Ray

Something like this:
frame[0x38:4]==74:72:61:70

On Wed, Jul 8, 2009 at 7:44 PM, Hague, Raymond [IDR]
<ray.hague@xxxxxxxx>wrote:

>  I am attempting to create a display filter but some how keep missing
the
> mark.  I would like to create a filter that would read:
>
>
>
> Beginning byte= 0038
>
> Length=         4
>
> Data            74:72:61:70
>
> -Ray