Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 8084] The display filter "tcp.data contains ff:ff:ff:ff" doesn't work, but "tc

[bugzilla-daemon@xxxxxxxxxxxxx]

Jeff Morriss changed bug 8084

What	Removed	Added
CC		jeff.morriss.ws@gmail.com

Comment # 3 on bug 8084 from Jeff Morriss

Yeah, I recently ran into this...  problem... recently.  It was slightly
frustrating to find that the ~45 minutes tshark spent looking for a pattern (in
fifty 500 Mb files) in "tcp.data" was wasted because I should have used "frame
contains" (or, it seems, "tcp contains").

But: I'm not sure it's really a bug.  As Chris said, it's quite common/normal
that things handed off to a sub-dissector don't show up as "<dissector>.data". 
OTOH I can certainly understand the confusion...  Hmmm, needs some thought.

---

      You are receiving this mail because:

• You are watching all bug changes.