frame contains "\x03\x00\x0e\xa8" display filter in wireshark displays packets not containing these bytes

network-programming wireshark packet-capture tcpdump wireshark-dissector
mezda picture mezda · Sep 20, 2012 · Viewed 9.1k times · Source

i used the following filter in wireshark to find the packets containing these bytes :

frame contains "\x03\x00\x0e\xa8"

but when i see the result of this filter, it displays more than 1k packets which don't even contain these bytes. For example, it even displays the following ethernet packet :

00219ba0610678e7d1c625f40800450000282a0340008006cd88c0a87801d43af65f059e00503bac54cf9f17722a5010ffff04e50000

Nowhere these bytes are contained in this packet. Similarly there are several other packets which are displayed while actually there are only two packets containing these bytes which are displayed as well. Can anyone let me know what is the issue here ? any help will be highly appreicated. thanks

Answer

willyo picture willyo · Sep 20, 2012

A quick test indicates that:

"\x03\x00\x0e\xa8" is treated as a search for a string with the \x00 terminating the search string. That is: the string actually being searched for is "\x03".

The following will work:

frame contains 03:00:0e:a8

See: Display Filters, Wireshark User's Guide, and ask.wireshark.org

Although not explicitly stated, "..." specifies a NULL-terminated search string in the usual C string constant fashion.

Related questions

how wireshark marks some packets as "tcp segment of a reassembled pdu"

I opened a pcap in wireshark and it displays a lot of packets as "tcp segment of a reassembled pdu". How wireshark is able to determine which tcp packets are segments of a reassembled pdu ? I am not able to …

Read More
How to copy hex data of captured packet form wireshark

here is the example this is the captured packet data 00000000 00 6e 0b 00 .n.. 00000004 4d 5a e8 00 00 00 00 5b 52 45 55 89 e5 81 c3 81 MZ.....[ REU..... 00000014 12 00 00 ff d3 89 c3 57 68 04 00 00 00 50 ff d0 .......W h....P.. 00000024 68 f0 b5 a2 56 68 05 00 00 00 50 ff d3 00 00 00 h...Vh.. ..P..... 00000034 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 ........ ........ 00000044 0e 1f …

Read More
How do I pump traffic using tcpreplay at 100 MBps, 500 MBps and 1Gbps speeds?

I used the -R and -K option but it doesnt seem to be working as I captured the pumped traffic using tcpdump and the number of packets that I see there dont seem to match the number of packets that …

Read More