How to write a filter in Wireshark/Ethereal that displays only packets with a specific string

wireshark

Wireshark supports filters like this:

ip.addr == 192.168.0.1

What is the syntax to check the packet content?

(C# equivalent of what I want)

content.Contains("whateverYouWant")

Best Answer

There seems not to be an generic way of doing this. The filter you need to apply is dependent on the protocol you are listening for. Try looking at the filter list at http://www.wireshark.org/docs/dfref/.

Related Question