On Tue, May 15, 2007 at 06:23:41AM -1100, Hans Nilsson wrote: > Coudln't he use slices? Something like "frame[30-33] == 1:3:58:59" (in > hex really but) or what fits his purposes.
The DHCP options might not be in the same order in every frame and also some variable length fields might be in the frame *before* the option you want to filter on. That would mess up the addresses in the frame[x-y] filter. Cheers, Sake _______________________________________________ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users
