ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: [Wireshark-dev] Display filter using wildcards

From: Ken Sarmago <ken@xxxxxxxxxxxxxx>
Date: Fri, 07 Sep 2012 10:55:26 +0800
Hi all,

I'm new to this list. First of all, kudos to all wireshark developers for a great tool.

I've been trying to create a Display filter for address fields using wildcards '*'.
e.g.
  of.match_dl_dst == 10:00:12:34:56:*
  of.match_dl_dst == 10:00:12:34:*:*
  of.match_dl_dst == 10:00:12:*:*:*
  of.match_dl_dst == 10:00:*:*:*:*
  of.match_dl_dst == 10:00:*:*:56:78

Has anyone done this before?

I know there are other filter expressions that can serve the same purpose, but
what if I really want to use wildcards '*'.

If I were to modify wireshark filter function, were will I start?

Thanks a lot in advance,
Ken