Wireshark · Wireshark-dev: Re: [Wireshark-dev] Does a filter expression allow searching with a string of bytes as decimal numbe

[chuck c <bubbasnmp@xxxxxxxxx>]

https://www.wireshark.org/docs/man-pages/wireshark-filter.html

"Also, this is not allowed for decimal numbers, since they would be confused with hex numbers that are already allowed as byte strings. "

On Sun, May 10, 2020 at 5:20 AM Jaap Keuter <jaap.keuter@xxxxxxxxx> wrote:

Well, simply entering three digit decimal values in the Wireshark display filter shows that it’s not a valid byte string, so hex only.
I do agree that this type could be (more clearly) described in the Users Guide.

Jaap

> On 9 May 2020, at 17:12, Richard Sharpe <realrichardsharpe@xxxxxxxxx> wrote:
>
> Hi folks,
>
> Suppose you have a field in packet that has been inserted as a byte string, say:
>
> some-proto.some-field =  0x21 0x32 0x81
>
> Can I search on "some-proto.some-field == 33:50:129" or does the
> filter _expression_ parser think those numbers between the colons are
> HEX digits?
>
> --
> Regards,
> Richard Sharpe
> (何以解憂？唯有杜康。--曹操)(传说杜康是酒的发明者)

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe