ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: Re: [Wireshark-users] wireshark display filters: display range of termination id

From: Martin Mathieson <martin.r.mathieson@xxxxxxxxxxxxxx>
Date: Thu, 13 Oct 2011 11:37:14 +0100


On Thu, Oct 13, 2011 at 11:33 AM, Martin Mathieson <martin.r.mathieson@xxxxxxxxxxxxxx> wrote:


On Thu, Oct 13, 2011 at 11:28 AM, Manolis Katsidoniotis <manoska@xxxxxxxxx> wrote:
Hello folks

I would like trying to display all ports from 1 to 40 (and filter out all others).
ip.addr == x.x.x.x && ( ( megaco.termid == "port_1" ) || ( megaco.termid == "port_2" ) || ( megaco.termid == "port_3" ) || ... )

gets too big for 40 ports I tried

ip.addr == x.x.x.x && ( ( megaco.termid >= "port_1" ) && ( megaco.termid <= "port_40" ) )

but it displays all 760 ports that I have

any ideas?


Surely you instead need:

ip.addr == x.x.x.x && ( ( megaco.termid >= "port_1" ) || ( megaco.termid <= "port_40" ) )

?
 

Ignore this, what was I thinking...

You probably need to experiment with what the various comparison (>=, <=, etc)  operators do on strings.
At best it'll be alphabetical, i.e. I seriously doubt "port_11" will be >= "port_4".

Martin

 
Thanks
Manolis

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe