display filter caps only

asked 2022-10-15 07:11:37 +0000

ccie2433 gravatar image

Searching for executable files that begin with ascii "MZ".

http contains MZ

I create the filter then Follow TCP Stream. I'm getting small cap hits (eg "mz"). I just want large cap hits (eg "MZ"). Using regex doesn't seem to work. Any way to specify case?

TIA

edit retag flag offensive close merge delete

Comments

Just to clarify:
- display filter http contains MZ is case sensitive
- Find: in the Follow TCP Stream window is not case sensitive

Chuckc gravatar imageChuckc ( 2022-10-15 14:24:20 +0000 )edit
add a comment