Ask Your Question

Revision history [back]

Check individual bits

Hi!

I am trying to filter on specific bits in the data section, but I am unable to get the results I want. I have already looked at these links which heavily relates with what I want to accomplish.

https://osqa-ask.wireshark.org/questions/21957/search-by-specific-bit-in-data-field/#:~:text=You%20can%20check%20for%20a,whether%20the%20bit%20is%20set.

https://osqa-ask.wireshark.org/questions/35598/filter-udp-frame-by-bit-instead-of-byte/

My filter atm: rtp.ext.rfc5285.data From there on I wanted filter the left most byte for its right most bit in the section. (want to see that the right most bit in the first byte is set. I dont care about the others--> 0000 0001 0000 0000) rtp.ext.rfc5285.data[0]&1 I then want to filter the three right most bits in the byte. rtp.ext.rfc5285.data[0]&1 and rtp.ext.rfc5285.data[0]&2 and rtp.ext.rfc5285.data[0]&3 I then do this !rtp.ext.rfc5285.data[0]&1 and !rtp.ext.rfc5285.data[0]&2 and !rtp.ext.rfc5285.data[0]&3 and rtp

The data it filtrates gives me a hex value in one of the packet of 0x000005f8702220 In binary the three right most bit in byte 0 is 111. I wanted them to be 000. What am I doing wrong?