Wireshark-users: Re: [Wireshark-users] Active filter
: "Christopher Wooley" <christopher@xxxxxxxxxxxxxxxxxxxx
: Tue, 08 Sep 2009 15:29:32 -0500
Under further information for "filtering while capturing":
it gives the example in the docs page:
tcp port 23 and host 10.0.0.5
if you type in tcp port 23, it gives the error, but if you use tcp.port==23, it doesn't
the correct syntax would have been tcp.port==23 and ip.src="">
Systems EngineerAsset Inventory ServicesOverdrive Advanced Computers
"Question with boldness."
"Those who give freedom for a little security deserve neither."
From: sean bzd [mailto:seanbzd@xxxxxxxxx]
To: Community support list for Wireshark [mailto:wireshark-users@xxxxxxxxxxxxx]
Sent: Tue, 08 Sep 2009 14:01:52 -0500
Subject: Re: [Wireshark-users] Active filter
I suppose you mean Display filter. Display filters work online(while capture is going on) and offline. Its syntax is different from capture filters. What does WIKI say about the syntax?