i have a pcap which contains only tcp packets. now i want to see only those packets which have non zero payload length. can someone please let me know which display filter to use ? using
data.len or tcp.pdu.size
doesnt help. please let me know the appropriate filter. Even
wont suffice as headers may be of different length. so some sort of filter like tcp.payload_len is required. any help will be greatly appreciated. thanks.