Wireshark

  • Riverbed Technology
  • WinPcap
the world's foremost network protocol analyzer
  • Wireshark
    • About
    • Download
    • Blog
  • Get Help
    • Ask a Question
    • FAQs
    • Documentation
    • Mailing Lists
    • Online Tools
    • Wiki
    • Bug Tracker
  • Develop
    • Get Involved
    • Developer's Guide
    • Browse the Code
    • Latest Builds

Wireshark-users: [Wireshark-users] Undocumented feature of display filter macros?

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next


From: Jakub Zawadzki <darkjames@xxxxxxxxxxxxxxxx>
Date: Wed, 9 Dec 2009 13:15:50 +0100

Hi,

I'm playing a little with wireshark internals and I found that it's
possible to make filters like:
   tcp.stream == ${tcp.stream} <-- filter current selected stream
   ip.addr == ${ip.src}        <-- find packets containing source address.

It's quite nice feature, but I couldn't find any documentation for it ;/

I only found general information about macros:
  http://www.wireshark.org/docs/wsug_html_chunked/ChDisplayFilterMacrosSection.html
  http://wiki.wireshark.org/DFilterMacro 

and proposal of this feature:
  http://www.wireshark.org/lists/wireshark-dev/200707/msg00314.html

any links?

  • Prev by Date: [Wireshark-users] (no subject)
  • Next by Date: [Wireshark-users] Detecting a TCP checksum error at capture time in tshark
  • Previous by thread: Re: [Wireshark-users] (no subject)
  • Next by thread: [Wireshark-users] Detecting a TCP checksum error at capture time in tshark
  • Index(es):
    • Date
    • Thread

Wireshark and the "fin" logo are registered trademarks of the Wireshark Foundation