Guy Harris wrote: > As for display filters, there are two issues: > > The first of which is that the constant operand of "&" must be a byte string, i.e. a sequence of > hex values separated by colons, so you have to say "c0" rather than "0xc0" for a one-byte value. > > The second of which is that, at least as I read the man page, that you can't do something such as > > (tcp[21] & c0) == 0 > > but you can do > > !(tcp[21] & c0) > > (Note also that those display and capture filters assume the TCP segment has no TCP options.)
Excellent, thanks for clearing this up for me. This works as intended and will assist me no end Cheers Greg _______________________________________________ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users
