Wireshark mailing list archives
Re: Display filter field variables
From: João Valverde via Wireshark-dev <wireshark-dev () wireshark org>
Date: Fri, 8 Oct 2021 16:35:17 +0100
Thanks a lot. :-) Seems like I was wrong and it's a macro after all. On 08/10/21 16:31, chuck c wrote:
Display Filter Macros of currently selected packet fieldshttps://gitlab.com/wireshark/wireshark/-/wikis/DFilterMacro <https://gitlab.com/wireshark/wireshark/-/wikis/DFilterMacro>https://gitlab.com/wireshark/wireshark/-/commit/9865b6346f6442bc8326cde55e5f012250748131 <https://gitlab.com/wireshark/wireshark/-/commit/9865b6346f6442bc8326cde55e5f012250748131>On Fri, Oct 8, 2021 at 10:10 AM João Valverde via Wireshark-dev <wireshark-dev () wireshark org <mailto:wireshark-dev () wireshark org>> wrote:Hi, The GUI display filter has an interesting but little-known (?) feature to replace field values for the selected frame with the syntax ${<field>}, which I only learned about in bug #15504, and confused me at first. This all happens before the expression is compiled and is different from display filter macros. Does anyone know more about this? And where it is implemented in the GUI code? ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org <mailto:wireshark-dev () wireshark org>> Archives: https://www.wireshark.org/lists/wireshark-dev <https://www.wireshark.org/lists/wireshark-dev> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev <https://www.wireshark.org/mailman/options/wireshark-dev> mailto:wireshark-dev-request () wireshark org <mailto:wireshark-dev-request () wireshark org>?subject=unsubscribe ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: https://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: https://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
Current thread:
- Display filter field variables João Valverde via Wireshark-dev (Oct 08)
- Re: Display filter field variables chuck c (Oct 08)
- Re: Display filter field variables João Valverde via Wireshark-dev (Oct 08)
- Re: Display filter field variables chuck c (Oct 08)