Packet Edit Studio Users Guide

Searching for Data

Accessing the Search Dialog

When a packet list or packet file is open the edit menu will contain a "Find" option:

Additionally you can hold CTRL + F3 to bring up the Data Search Dialog

Search Options

The search dialog consists of a search edit box as well as three fields to specify the exact type of search you want to do:

Length Field

The length field allows you to specify the size of the search you want to do. The options are:

• String: The number of bytes compared depends on the input.
• BYTE: Exactly one byte will be compared.
• WORD: Exactly two bytes will be compared.
• DWORD: Exactly four bytes will be compared.

Format Field

The format field tells the search function what type of comparison should be used:

• ASCII: The search input will be matched exactly based on 8 bit characters.
• Unicode: The search input will be matched exactly based on 16 bit characters.
• Dec: The input will be converted to a decimal (BASE 10) number and compared.
• Hex: The input will be converted to a hexadecimal (BASE 16) number and compared.
• Oct: The input will be converted to a octal (BASE 8) number and compared.
• Bin: The input will be converted to a binary (BASE 2) number and compared.

Additional Options

If you are comparing a Unicode or ASCII string you can also specify case sensitivity. By default searches are not case sensitive.

Acceptable Combinations

Not all Formats, Options, and Lengths can be combined together:

	String	BYTE	WORD	DWORD	Case Sensitive
ASCII	Y	N	N	N	Y
Unicode	Y	N	N	N	Y
Dec	N	Y	Y	Y	N
Hex	Y	Y	Y	Y	N
Oct	N	Y	Y	Y	N
Bin	N	Y	Y	Y	N

Hex strings are a special case. If you specify the "Hex" format with the "String" length then the input will be converted to an array of bytes. Hex digits in a hex string should be entered as groups of two characters: each representing one byte. There should be no spaces between the hex digits. If three characters are entered, the last will be padded with a leading "0":

"3A7F" compares \x3A\x7F.
"3A7" compares \x3A\x07".