Wireshark · Wireshark-users: Re: [Wireshark-users] Searching for a particular sequence in a packet

[Stephen Fisher <steve@xxxxxxxxxxxxxxxxxx>]

On Sep 25, 2009, at 12:06 AM, Hussain wrote:

> Also I was just wondering it was possible to search with offsets.  
> For example, I want to search for packets where the first byte is  
> let's say \xe3 (HEX), and then after four bytes, I get the string  
> \x45 (HEX value). I.e. one such possible sequence could be, e3 09 08  
> ff f3 45.

This page should help with display filters:

  http://www.wireshark.org/docs/wsug_html_chunked/ChWorkBuildDisplayFilterSection.html