Wireshark · Ethereal-dev: Re: [Ethereal-dev] New feature to Find. Search all PD structures for ASCII or HEX data.

[Guy Harris <guy@xxxxxxxxxxxx>]

On Friday, July 18, 2003, at 10:13 AM, Greg Morris wrote:

> Please consider this new addition. Many times I have been asked why  
> Ethereal cannot search the hex data for a pattern of characters or hex  
> values. I spent a little time adding this new functionality.

You might want to look at using, for example, a Boyer-Moore search:

	http://www.cs.utexas.edu/users/moore/best-ideas/string-searching/ 
index.html

as it's faster than the quadratic-time simple search you appear to be  
doing.  (Gilbert, what search algorithm are you using?)

Hex patterns should probably be turned into binary patterns before the  
search starts.

The direct "search for a text or binary string anywhere in the packet"  
UI could perhaps be done as "frame contains <string>" in a display  
filter, which would allow it to be used in Tethereal as well, and would  
let that feature share code with Gilbert's stuff.