Wireshark · Wireshark-users: Re: [Wireshark-users] question about fancy DHCP display filtering

[Guy Harris <guy@xxxxxxxxxxxx>]

Hans Nilsson wrote:
> Coudln't he use slices? Something like "frame[30-33] == 1:3:58:59" (in
> hex really but) or what fits his purposes.

He could, if he knows the *exact* offset from the beginning of the 
BOOTP/DHCP packet of the field in question.

That assumes, of course, that it *has* an exact offset.  The offset of a 
given option depends on what options are in the packet before the option 
you're checking, so it might be different in different packets.