Wireshark · Wireshark-users: Re: [Wireshark-users] question about fancy DHCP display filtering

[Sake Blok <sake@xxxxxxxxxx>]

On Tue, May 15, 2007 at 06:23:41AM -1100, Hans Nilsson wrote:
> Coudln't he use slices? Something like "frame[30-33] == 1:3:58:59" (in
> hex really but) or what fits his purposes.

The DHCP options might not be in the same order in every frame and also
some variable length fields might be in the frame *before* the option
you want to filter on. That would mess up the addresses in the frame[x-y]
filter.

Cheers,


Sake