I can filter for packet lengths using a display filter containing data.len >= XXX, but I'd really like to use a capture filter for this for efficiency... is there a way to do it?
-
1Kyle's answer is correct. If you ever do need to use the display filter again, frame.len would be a better choice. "frame" is guaranteed to match every packet. The "data" dissector is usually only called as a last resort, and may not match very many packets.– Gerald CombsFeb 5, 2010 at 19:47
-
cool, thanks for the info. I'll use frame.len from now on.– oz10Feb 8, 2010 at 14:58
Add a comment
|
2 Answers
As you said in your comment:
greater <length>
less <length>
They also happen to be in this handy tcpdump cheat sheet I have on my wall.
Wireshark uses the same capture filter syntax as tcpdump, and it doesn't look like that's an option