Wireshark · Wireshark-users: Re: [Wireshark-users] Filter for DNS tcp flags?

[Jaap Keuter <jaap.keuter@xxxxxxxxx>]

Hi,

You're confused. It's dns.flags what you're looking for.
In fact "dns.flags.rcode == 3" is what you want to use as display filter.

Thanx,
Jaap

Scott Baker wrote:
> I want to filter out all DNS queries that fail with a "no such name"
> response. As far as I can tell that's tcp flag 0x8583, but I don't
> know how to filter for that. The docs say tcp.flags is an 8 bit field,
> so it can't be 0x8583. How do I filter DNS for specific flags?
>
> - Scott