Search code examples
wireshark

How to create a wireshark display filter with wildcard?


Suppose I have a pattern like

01:02:(anything):04:05

How can I construct a display filter in wireshark to filter it out?

Must I do this?

data[0:2]==01:02 and data[3:2]==04:05

Solution

  • If you are not sure how many letter are in between the string you can use below filter

    data.data ~ Hel.{1,}rld

    or

    data.data matches Hel.{1,}rld

    here .{1,} means 1 or more characters in between & the letter should start from hel (in between anything) than ends with rld