[Wireshark-users] Display Filter frame - how do that work?

Hello,

today I made a trace and I wanted to see all the DHCPNAK.

For this I found a filter:

frame[282:3] == 35:01:06

It works perfect. But my question is how is this filter defined.

For example frame[282:3] == 35:01:02 would be DHCPOFFER.

So {282:3] must be then DHCP. But how is that defined? Is that an offset?
some bit? just a fix list?

and what is 35:01:06.

Any help would be greatly appreciated.

thanx a lot and have a nice day,

cheers,
Juergen

___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users@wireshark.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request@wireshark.org?subject=unsubscribe

• This message: [ Message body ]
• Next message: Sven Aluoor: "[Wireshark-users] who sends RST packets? UNIX box or application? Troubleshooting hints?"
• Previous message: Ding, Ming Ling (Doris): "Re: [Wireshark-users] Wireshark Crash--Error:lua5.1.dll Offset:0000c572"
• Next in thread: Marco Simone Zuppone: "Re: [Wireshark-users] Display Filter frame - how do that work?"
• Reply: Marco Simone Zuppone: "Re: [Wireshark-users] Display Filter frame - how do that work?"
• Reply: Jaap Keuter: "Re: [Wireshark-users] Display Filter frame - how do that work?"

• Contemporary messages sorted: [ By Date ] [ By Thread ] [ By Subject ] [ By Author ]