Wireshark mailing list archives

Undocumented feature of display filter macros?


From: Jakub Zawadzki <darkjames () darkjames ath cx>
Date: Wed, 9 Dec 2009 13:15:50 +0100

Hi,

I'm playing a little with wireshark internals and I found that it's
possible to make filters like:
   tcp.stream == ${tcp.stream} <-- filter current selected stream
   ip.addr == ${ip.src}        <-- find packets containing source address.

It's quite nice feature, but I couldn't find any documentation for it ;/

I only found general information about macros:
  http://www.wireshark.org/docs/wsug_html_chunked/ChDisplayFilterMacrosSection.html
  http://wiki.wireshark.org/DFilterMacro 

and proposal of this feature:
  http://www.wireshark.org/lists/wireshark-dev/200707/msg00314.html

any links?
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe


Current thread: