Quantcast
Channel: User Dominique - Super User
Viewing all articles
Browse latest Browse all 176

How can I find TCP packets with specific data in a Wireshark capture?

$
0
0

I'm trying to find a bunch of specific data in a Wireshark capture.
First of all I need to be sure that the data is actually there, which has been confirmed in my previous post.

Now I'd like to go a step further and actually filter the mentioned data.

At this moment I'm capable of creating the following filter:

ip.dst == 10.1.0.160 && tcp.port == 12714 && data.len >=1

As you can see, this filters the Wireshark capture on a certain IP address and corresponding TCP port, containing non-empty data, but I'd like to go further on the "data" filtering part:

My "data" always contains the fix letters "MFS1", is there a way I can filter on that?

I know that "MFS1" is 4D 46 53 31 in hexadecimal, can I filter on data.like('%4D465331%'), something like that?


Viewing all articles
Browse latest Browse all 176

Trending Articles