Comment # 2
on bug 8084
from Chris Maynard
This happens because the TCP dissector hands off the data to the "data"
dissector in this case. Therefore, "tcp contains ff:ff:ff:ff" works as does
"data contains ff:ff:ff:ff" (or even "data.data contains ff:ff:ff:ff"), but
"tcp.data contains ff:ff:ff:ff" does not.
A lot of protocols hand off undissected data to the "data" dissector, so I
think this issue applies to more than just the TCP dissector.
You are receiving this mail because:
- You are watching all bug changes.
