display filter caps only

asked 2022-10-15 07:11:37 +0000

Searching for executable files that begin with ascii "MZ".

http contains MZ

I create the filter then Follow TCP Stream. I'm getting small cap hits (eg "mz"). I just want large cap hits (eg "MZ"). Using regex doesn't seem to work. Any way to specify case?


edit retag flag offensive close merge delete


Just to clarify:
- display filter http contains MZ is case sensitive
- Find: in the Follow TCP Stream window is not case sensitive

Chuckc gravatar imageChuckc ( 2022-10-15 14:24:20 +0000 )edit