Wireshark · Ethereal-users: Re: [Ethereal-users] [U] dhcp OPTIONS filter

[Jaap Keuter <jaap.keuter@xxxxxxxxx>]

Hi,

First make sure your version of Ethereal has been linked with PCRE (see
menu option Help|About Ethereal. It says something like: "...with libz
1.2.3, with libpcre 6.4, with Net-SNMP 5.2.2, with ADNS....". It has to
say "with libpcre".

Then enter this display filter expression:
bootp contains RRAS.Microsoft

Thanx,
Jaap

On Tue, 25 Apr 2006, Baker Garry L CIV Raytheon 72nd Sig BN IANE wrote:

> I need to create a filter to look for a RAS server running on W2K
>
> "Windows 2000 RAS packets have the string, RRAS.Microsoft, hardcoded
> into the dhcp-user-class-id field."
>
> Dhcp-user-class-id is OPTION number 77
>
> I just do not clearly understand the filter syntax in Ethereal to seach
> for RRAS.Microsoft
>
> Can someone please enlighten me on what this filter might look like? I
> assume this will be a display expression and cannot be a capture
> filter...