Hans Nilsson wrote: > Coudln't he use slices? Something like "frame[30-33] == 1:3:58:59" (in > hex really but) or what fits his purposes.
He could, if he knows the *exact* offset from the beginning of the BOOTP/DHCP packet of the field in question. That assumes, of course, that it *has* an exact offset. The offset of a given option depends on what options are in the packet before the option you're checking, so it might be different in different packets. _______________________________________________ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users
