Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Setup the filter as string instead of frame[start offset:len

From: Gilbert Ramirez <gram@xxxxxxxxxxxxxxx>
Date: Wed, 8 Aug 2012 06:20:54 -0700
For some reason your screenshots did not get included. Perhaps you can upload them somewhere and provide URLs to them?

Gilbert

On Wed, Aug 8, 2012 at 6:05 AM, Kumar, Chandan (Chandan) <chandan.kumar@xxxxxxxxxxxxxxxxxx> wrote:
My request as follows:
Could you, please help me to make change in Wireshark so that I would be able to select IE by means of filter like others element?
 
I want to make IE’s as a filterable field instead of displaying frame [start offset: length]
 
Did some change for this into epan/proto.c file in Wireshark – 1.6.2
Line number---->6934
 
ptr += g_snprintf(ptr, (gulong) (buf_len-(ptr-*filter)), "frame[%d:%d] == ", finfo->start, length);   
 
this line I have change like
ptr += g_snprintf(ptr, (gulong) (buf_len-(ptr-*filter)),"%s == ", finfo->rep->representation);
 
I am able to see the strings which want to make filterable using (Apply as filter ---> Selected) but some wrong message windows came & stop the parsing for new filter.
Attaching two snap shot 1st with the Wireshark filter & 2nd what I have implemented.
 
                                                       
 
 
Thanks
Chandan
 
 
 

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe