The stream app can save pcaps using the configure packet stream. I was able to get packets saved using just IPs. Now I want to search for content based on some snort rules. For ascii content I am trying to create new target using the field: content/contains by just putting in an ascii word. For hex values, there are no instructions. Do I use escape characters \x01\x02...., |01 02 ...| or a regular expression? Is there an example.
