Wireshark · Wireshark-users: [Wireshark-users] Display Filter frame - how do that work?

[Jürgen Dietl <juergen.dietl@xxxxxxxxxxxxxx>]

Hello,

today I made a trace and I wanted to see all the DHCPNAK.

For this I found a filter: 

frame[282:3] == 35:01:06

It works perfect. But my question is how is this filter defined.

For example frame[282:3] == 35:01:02 would be DHCPOFFER.

So {282:3] must be then DHCP. But how is that defined? Is that an offset? some bit? just a fix list?

and what is 35:01:06.


Any help would be greatly appreciated.

thanx a lot and have a nice day,

cheers,
Juergen