Wireshark · Wireshark-users: Re: [Wireshark-users] Case insensitive display filter?

[Gerald Combs <gerald@xxxxxxxxxxxxx>]

Ulf Lamping wrote:
> Hi!
> 
> Is there a way to (display) filter out packets case insensitive?
> 
> I mean you can do something like:
> 
>    pn_dcp.suboption_device_nameofstation == "Rack02xF-Device-03"
> || pn_dcp.suboption_device_nameofstation == "rack02xf-device-03"
> 
> But is there a way to do a more generic case insensitive filter, maybe 
> using pcre?

You can use the "lower" function:

    lower(pn_dcp.suboption_device_nameofstation) == "rack02xf-device-03"

or the "i" flag in the PCRE:

    pn_dcp.suboption_device_nameofstation matches "(?i)Rack02xF-Device-03"

If you use the "lower" function, the comparison string must be all lower-case.
With the "matches" operator, it can be mixed case (which I find to be less
error-prone).