How can I find TCP packets with specific data in a Wireshark capture?

Question

I'm trying to find a bunch of specific data in a Wireshark capture.
First of all I need to be sure that the data is actually there, which has been confirmed in my previous post.

Now I'd like to go a step further and actually filter the mentioned data.

At this moment I'm capable of creating the following filter:

ip.dst == 10.1.0.160 && tcp.port == 12714 && data.len >=1

As you can see, this filters the Wireshark capture on a certain IP address and corresponding TCP port, containing non-empty data, but I'd like to go further on the "data" filtering part:

My "data" always contains the fix letters "MFS1", is there a way I can filter on that?

I know that "MFS1" is 4D 46 53 31 in hexadecimal.
Can I filter on data.like('%4D465331%'), something like that?

Answer 1

You can use the contains keyword, like this:

ip.dst == ... && tcp.port == ... && data.len >=1 && 
frame contains "MSF1"