Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

Display filter udp slice not working in udp payload

Using Wireshark 4.2.0, display filter udp[8]==8C produces no results in the example below. With version 3.6.1, the frame is displayed.

With 4.2.0 udp.payload[0]==8C and data.data[0]==8C work, but that makes complex filters way too long. Did I miss the memo that slicing into the UDP payload no longer works?

image description

Display filter udp slice not working in udp payload

Using Wireshark 4.2.0, display filter udp[8]==8C produces no results in the example below. With version 3.6.1, the frame is displayed.

With 4.2.0 udp.payload[0]==8C and data.data[0]==8C work, but that makes complex filters way too long. Did I miss the memo that slicing into the UDP payload no longer works?

image descriptionwireshark screenshot

Display filter udp slice not working in udp payload

Using Wireshark 4.2.0, display filter udp[8]==8C produces no results in the example below. With version 3.6.1, the frame is displayed.

With 4.2.0 udp.payload[0]==8C and data.data[0]==8C work, but that makes complex filters way too long. Did I miss the memo that slicing into the UDP payload no longer works?

wireshark screenshot

Display filter udp slice not working in udp payload

Using Wireshark 4.2.0, display filter udp[8]==8C produces no results in the example below. With version 3.6.1, the frame is displayed.

With 4.2.0 udp.payload[0]==8C and data.data[0]==8C work, but that makes complex filters way too long. Did I miss the memo that slicing into the UDP payload no longer works?

wireshark screenshotwireshark screenshot

Display filter udp slice not working in udp payload

Using Wireshark 4.2.0, display filter udp[8]==8C produces no results in the example below. With version 3.6.1, the frame is displayed.

With 4.2.0 udp.payload[0]==8C and data.data[0]==8C work, but that makes complex filters way too long. Did I miss the memo that slicing into the UDP payload no longer works?

wireshark screenshot

Display filter udp slice not working in udp payload

Using Wireshark 4.2.0, display filter udp[8]==8C produces no results in the example below. With version 3.6.1, the frame is displayed.

With 4.2.0 udp.payload[0]==8C and data.data[0]==8C work, but that makes complex filters way too long. Any slice for bytes 0 through 7 are good (UDP header). Did I miss the memo that slicing into the UDP payload no longer works?

wireshark screenshot

Display filter udp slice not working in udp payload

Using Wireshark 4.2.0, display filter udp[8]==8C produces no results in the example below. With version 3.6.1, the frame is displayed.

With 4.2.0 udp.payload[0]==8C and data.data[0]==8C work, but that makes complex filters way too long. Any slice slices for bytes 0 through 7 are good (UDP header). Did I miss the memo that udp[n] slicing into the UDP payload no longer works?

wireshark screenshot