Thanks a lot. :-)
Seems like I was wrong and it's a macro after all.
On 08/10/21 16:31, chuck c wrote:
Display Filter Macros of currently selected packet fields
https://gitlab.com/wireshark/wireshark/-/wikis/DFilterMacro
<https://gitlab.com/wireshark/wireshark/-/wikis/DFilterMacro>
https://gitlab.com/wireshark/wireshark/-/commit/9865b6346f6442bc8326cde55e5f012250748131
<https://gitlab.com/wireshark/wireshark/-/commit/9865b6346f6442bc8326cde55e5f012250748131>
On Fri, Oct 8, 2021 at 10:10 AM João Valverde via Wireshark-dev
<wireshark-dev@xxxxxxxxxxxxx <mailto:wireshark-dev@xxxxxxxxxxxxx>> wrote:
Hi,
The GUI display filter has an interesting but little-known (?) feature
to replace field values for the selected frame with the syntax
${<field>}, which I only learned about in bug #15504, and confused
me at
first. This all happens before the expression is compiled and is
different from display filter macros.
Does anyone know more about this? And where it is implemented in the
GUI
code?
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx
<mailto:wireshark-dev@xxxxxxxxxxxxx>>
Archives: https://www.wireshark.org/lists/wireshark-dev
<https://www.wireshark.org/lists/wireshark-dev>
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
<https://www.wireshark.org/mailman/options/wireshark-dev>
mailto:wireshark-dev-request@xxxxxxxxxxxxx
<mailto:wireshark-dev-request@xxxxxxxxxxxxx>?subject=unsubscribe
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives: https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe
