First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

Display filter in 3.7.1 receives invalid syntax

I used to filter on bytes strings like 

tcp[12:2,14:2]==a012:111c

and get a Invalid filter:"111c" was unexpected in this context in the new release

Is that intended or a bug ? Regards Matthias

mrEEde's avatar
4k
mrEEde
asked 2022-07-27 06:28:40 +0000
edit flag offensive 0 remove flag close merge delete

Comments

Probably best to raise an issue at GitLab for this, there have been a lot of changes in the filtering code that this might be an unintended regression.

grahamb's avatar grahamb (2022-07-27 08:08:21 +0000) edit
more
  • delete

Created #18227 as a GitLab issue.

mrEEde's avatar mrEEde (2022-07-28 14:57:49 +0000) edit
more
  • delete
add a comment see more comments

2 Answers

1

I thinks this has always been supposed to be tcp[12:2,14:2]==a0:12:11:1c, but never enforced. It's being enforced now.

Jaap's avatar
13.7k
Jaap
answered 2022-07-27 08:26:30 +0000
edit flag offensive 0 remove flag delete link
more

Comments

add a comment see more comments
0

As per the discussion in GitLab item #18227 the filter parser no longer supports the colon separating 2-byte strings

The parser now rejects 1503:03 as an invalid byte string. This must be written 150303 or 15:03:03.

mrEEde's avatar
4k
mrEEde
answered 2022-07-28 20:23:01 +0000
edit flag offensive 0 remove flag delete link
more

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer