Ian Schorr wrote: <Is it possible for me to build a filter/search on a particular string <that may occur anywhere inside the packet view or tree view?
The thing I do is to print to a file from Ethereal (File/Print... Format (x) Plain Text, Print to (x) File, (x) Print detail) and do the search in a text editor or similar, or use tethereal with "-x" flag to generate the text output. http://www.ethereal.com/lists/ethereal-users/200303/msg00264.html There is also a program called ngrep that could be useful in certain cases, I think. I haven't used it so much myself. It's a grep program for libpcap files. http://www.packetfactory.net/projects/ngrep/ <ngrep -t -i -I infile.pcap "searchforthistext" tcp port 80
