Wireshark

  • Riverbed Technology
  • WinPcap
the world's foremost network protocol analyzer
  • Wireshark
    • About
    • Download
    • Blog
  • Get Help
    • Ask a Question
    • FAQs
    • Documentation
    • Mailing Lists
    • Online Tools
    • Wiki
    • Bug Tracker
  • Develop
    • Get Involved
    • Developer's Guide
    • Browse the Code
    • Latest Builds

Wireshark-users: Re: [Wireshark-users] Custom Columns & combining filters

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next


From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 7 Oct 2009 09:40:34 -0700


On Oct 7, 2009, at 2:32 AM, Keith French wrote:

In the latest version of Wireshark, when you add a custom column under the Preferences/User Interface, is it possible to define the filter using two or more expressions?

I don't see any filter in the dialog box for a column. I do see something that says "Field name", but nothing that says "Filter".

Either of these two filters are valid on their own, but if I try to combine them to be one column the syntax checker remains a red background:-

(dpnss.cc_msg_type)||(dpnss.e2e_msg_type)

That's not a field name.  What is it you're trying to do?

  • Follow-Ups:
    • Re: [Wireshark-users] Custom Columns & combining filters
      • From: Martin Visser
  • References:
    • [Wireshark-users] Custom Columns & combining filters
      • From: Keith French
  • Prev by Date: [Wireshark-users] SMTP and tshark fields
  • Next by Date: Re: [Wireshark-users] Custom Columns & combining filters
  • Previous by thread: Re: [Wireshark-users] Custom Columns & combining filters
  • Next by thread: Re: [Wireshark-users] Custom Columns & combining filters
  • Index(es):
    • Date
    • Thread

Wireshark and the "fin" logo are registered trademarks of the Wireshark Foundation