Wireshark mailing list archives
Re: Display filter field variables
From: chuck c <bubbasnmp () gmail com>
Date: Fri, 8 Oct 2021 10:31:43 -0500
Display Filter Macros of currently selected packet fields https://gitlab.com/wireshark/wireshark/-/wikis/DFilterMacro https://gitlab.com/wireshark/wireshark/-/commit/9865b6346f6442bc8326cde55e5f012250748131 On Fri, Oct 8, 2021 at 10:10 AM João Valverde via Wireshark-dev < wireshark-dev () wireshark org> wrote:
Hi, The GUI display filter has an interesting but little-known (?) feature to replace field values for the selected frame with the syntax ${<field>}, which I only learned about in bug #15504, and confused me at first. This all happens before the expression is compiled and is different from display filter macros. Does anyone know more about this? And where it is implemented in the GUI code? ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: https://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org ?subject=unsubscribe
___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: https://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
Current thread:
- Display filter field variables João Valverde via Wireshark-dev (Oct 08)
- Re: Display filter field variables chuck c (Oct 08)
- Re: Display filter field variables João Valverde via Wireshark-dev (Oct 08)
- Re: Display filter field variables chuck c (Oct 08)