libpcap(3), which uses a filter syntax documented in the
pcap-filter(7) man page.
You might want to skip down to the
expr relop expr section, and the square-bracket notation:
expr relop expr
True if the relation holds, where relop is one of >, <, >=, <=, =, !=, and
expr is an arithmetic expression composed of integer constants (expressed in
standard C syntax), the normal binary operators [+, -, *, /, &, |, <<, >>], a
length operator, and special packet data accessors. Note that all compar-
isons are unsigned, so that, for example, 0x80000000 and 0xffffffff are > 0.
To access data inside the packet, use the following syntax:
proto [ expr : size ]
Proto is one of ether, fddi, tr, wlan, ppp, slip, link, ip, arp, rarp, tcp,
udp, icmp, ip6 or radio, and indicates the protocol layer for the index oper-
ation. (ether, fddi, wlan, tr, ppp, slip and link all refer to the link
layer. radio refers to the "radio header" added to some 802.11 captures.)
Note that tcp, udp and other upper-layer protocol types only apply to IPv4,
not IPv6 (this will be fixed in the future). The byte offset, relative to
the indicated protocol layer, is given by expr. Size is optional and indi-
cates the number of bytes in the field of interest; it can be either one,
two, or four, and defaults to one. The length operator, indicated by the
keyword len, gives the length of the packet.
So for example, if you wanted to filter out packets with 0x23 at location 42 of the payload of an Ethernet-II frame, that would be at offset 56 of the overall Ethernet frame (your offset of 42 plus an offset of 14 bytes to get past the Ethernet headers to the payload), so you could do something like this:
ether != 0x23
I didn't fully read up on gsmtap so I'm not guaranteeing that the above filter is exactly what you need, but it should start you in the right direction.