Re: Launching a new window from Display filters

[Christopher Maynard <Christopher.Maynard () gtech com>]

FS <bastiji@...> writes:

> Thank you for the replies. Both excellent suggestions. Here's another one for
you gurus then. Lets say I start with a 1 Gig capture file. I see a lot of
extraneous chit-chat which I want to completely eradicate and then look at the
rest of the streams left. I was thinking more of an option of choose a display
filter, and then an option to sort of "discard" the results of the filter and
focus on the rest of the capture/conversations.An example could be using a
display filter to filter out the broadcast/arp/multicast traffic, and then
analyze the leftover data. Again, this can be accomplished by saving the
resulting 'noise-free' capture, and then re-opening it to further dissect it,
but is there another way to do this?Many thanks for the responses so
far!Regards,Basti

You can apply a display filter, for example, "arp", then choose, "Edit -> Ignore
All Displayed Packets (toggle)".  This doesn't discard them, per se, but those
packets will no longer match any future display filters you might apply, as
Wireshark will now ignore them as if they were no longer present.

Ref: http://www.wireshark.org/docs/wsug_html_chunked/ChWorkIgnorePacketSection.html


___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe