filter cant detect exist packet
this filter can detect following packet.
ip.src == 203.141.241.0/24 && data.data matches"\xcc\xcc.{6,6}\x37\x11"
but this filter cannot detect.
ip.src == 203.141.241.0/24 && data.data matches"\xcc\xcc.{6,6}\x37\x11.*\x24\x02"
packet containing \x24\x02 in line 0x02a0. anyone knows reason?
No. Time Source Destination Protocol Length Info 12465 2023-12-06 18:23:41.411340 203.141.241.23 192.168.1.4 TCP 872 54632 → 49181 [PSH, ACK] Seq=86956 Ack=4631 Win=507 Len=818 Frame 12465: 872 bytes on wire (6976 bits), 872 bytes captured (6976 bits) on interface \Device\NPF_{92F34A3C-A9F7-49AC-9AFB-65AD6643BC83}, id 0 Ethernet II, Src: NECPlatforms_d5:52:36 (00:0d:02:d5:52:36), Dst: VMware_e5:42:ec (00:0c:29:e5:42:ec) Internet Protocol Version 4, Src: 203.141.241.23, Dst: 192.168.1.4 Transmission Control Protocol, Src Port: 54632, Dst Port: 49181, Seq: 86956, Ack: 4631, Len: 818 Data (818 bytes)
0000 09 00 00 00 00 00 00 ff ff 20 75 38 00 57 c0 43 ......... u8.W.C
0010 00 00 00 00 00 41 08 00 00 00 00 00 00 ff ff 20 .....A.........
0020 75 38 00 e4 c0 43 00 00 00 00 00 41 08 00 00 00 u8...C.....A....
0030 00 00 00 ff ff b3 3b fd 00 4e 36 3e 00 00 00 00 ......;..N6>....
0040 00 c1 01 00 00 00 00 00 00 ff ff b3 3b fd 00 87 ............;...
0050 e6 4b 00 00 00 00 00 41 09 00 00 00 00 00 00 ff .K.....A........
0060 ff 10 00 2a 12 00 00 63 1a 3c 18 3f 00 64 00 ff ...*...c.<.?.d..
0070 ff 12 00 97 12 00 00 01 00 2c 00 0c 00 02 00 00 .........,......
0080 00 00 00 10 00 2a 12 00 00 63 1a 3c 18 3f 00 64 .....*...c.<.?.d
0090 00 ff ff 12 00 97 12 00 00 01 00 2c 00 0c 00 02 ...........,....
00a0 00 00 00 00 00 10 00 2a 12 00 00 63 1a 3c 18 3f .......*...c.<.?
00b0 00 64 00 ff ff 12 00 97 12 00 00 01 00 2c 00 0c .d...........,..
00c0 00 02 00 00 00 00 00 10 00 2a 12 00 00 63 1a 3c .........*...c.<
00d0 18 3f 00 64 00 ff ff 10 00 2a 12 00 00 63 1a 3c .?.d.....*...c.<
00e0 18 3f 00 64 00 ff ff 10 00 2a 12 00 00 63 1a 3c .?.d.....*...c.<
00f0 18 3f 00 64 00 ff ff 10 00 2a 12 00 00 63 1a 3c .?.d.....*...c.<
0100 18 3f 00 64 00 ff ff 10 00 2a 12 00 00 63 1a 3c .?.d.....*...c.<
0110 18 3f 00 64 00 ff ff ab 00 07 14 ...