Wireshark · Wireshark-dev: Re: [Wireshark-dev] Display filter field variables

[chuck c <bubbasnmp@xxxxxxxxx>]

Display Filter Macros of currently selected packet fields

https://gitlab.com/wireshark/wireshark/-/wikis/DFilterMacro

https://gitlab.com/wireshark/wireshark/-/commit/9865b6346f6442bc8326cde55e5f012250748131

On Fri, Oct 8, 2021 at 10:10 AM João Valverde via Wireshark-dev <wireshark-dev@xxxxxxxxxxxxx> wrote:

Hi,

The GUI display filter has an interesting but little-known (?) feature
to replace field values for the selected frame with the syntax
${<field>}, which I only learned about in bug #15504, and confused me at
first. This all happens before the _expression_ is compiled and is
different from display filter macros.

Does anyone know more about this? And where it is implemented in the GUI
code?
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe