Wireshark mailing list archives
Undocumented feature of display filter macros?
From: Jakub Zawadzki <darkjames () darkjames ath cx>
Date: Wed, 9 Dec 2009 13:15:50 +0100
Hi, I'm playing a little with wireshark internals and I found that it's possible to make filters like: tcp.stream == ${tcp.stream} <-- filter current selected stream ip.addr == ${ip.src} <-- find packets containing source address. It's quite nice feature, but I couldn't find any documentation for it ;/ I only found general information about macros: http://www.wireshark.org/docs/wsug_html_chunked/ChDisplayFilterMacrosSection.html http://wiki.wireshark.org/DFilterMacro and proposal of this feature: http://www.wireshark.org/lists/wireshark-dev/200707/msg00314.html any links? ___________________________________________________________________________ Sent via: Wireshark-users mailing list <wireshark-users () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-users Unsubscribe: https://wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-request () wireshark org?subject=unsubscribe
Current thread:
- Undocumented feature of display filter macros? Jakub Zawadzki (Dec 09)