Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Wireshark supports filters like this:

ip.addr == 192.168.0.1

What is the syntax to check the packet content?

(C# equivalent of what I want)

content.Contains("whateverYouWant")
share|improve this question

2 Answers 2

up vote 1 down vote accepted

There seems not to be an generic way of doing this. Filter you need to apply is dependent on the protocol you are listening. Try looking at filter list at http://www.wireshark.org/docs/dfref/.

share|improve this answer

Try the "contains" or "matches" operators.

tcp contains "an aloof iguana"
http matches "my pass.+ is(?i)"

Contains does a simple case-sensitive string comparison, and is guaranteed to be in every Wireshark package. Matches lets you apply Perl-compatible regular expressions. Its availability depends on your platform. You can also use contains with byte strings:

ip contains 01:ab:9c:45
share|improve this answer
    
It did not work on Wireshark 1.2.3 neither it is in the documentation –  Jader Dias Nov 24 '09 at 11:22
    
What filter string are you trying to use? (...and you're not trying to apply this as a capture filter, are you?) It looks like we need to add "matches" and "contains" to the User's Guide but you can find examples at wiki.wireshark.org/DisplayFilters –  Gerald Combs Nov 24 '09 at 16:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.