ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: [Wireshark-dev] display filter for expert/tcp analysis info

From: Nathan Jennings <njen@xxxxxxxxxxxx>
Date: Thu, 24 Jul 2008 23:12:15 -0400
Hello,

Is there a way to use the display filter syntax to filter packets based on the expert/tcp analysis output (strings)?

What I'd like to do is construct a display filter that matches an expert/tcp analysis string like "TCP segment lost", or something similar. I could then use this filter in the IO Graph window to show/highlight the affected packets in the line graph.

I looked at the wishlist on the Wiki but didn't see anything.

Any ideas on how difficult this might be to implement? Maybe point me to where I might get started?

Thanks, -Nathan