ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] Wish: Mark/Find the element matching the display filter

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 19 Nov 2007 14:58:16 -0800
Stephen Fisher wrote:

My bad, it does work as I had intended.  It highlights the field (with
the function highlight_field()) whenever you do a hex or string search,
but not when you do a filter search.  Should we add filter search
matches too?

I'd say "yes" - if a search pattern of any sort matches a packet because it matches a particular field in the packet, it should highlight the matching field regardless of the type of the match.

That does raise an interesting question - if a pattern matches *more than one* field in a packet, should "find next" find the next instance that matches, even if it's in the same packet, or should it find the next instance in that packet and, if there is no next instance in that packet, search subsequent packets? There are probably places where the former is useful and places where the latter is useful.