This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi,

We have current automation framework that uses wireshark version 1.2. We would like to use wireshark version 1.6.7. But the problem is, there are some display filters that are changed from 1.2.x to 1.6.7. I would like to get list of filters that are changed so that I can just change those in my automation framework. With out this data, I'll need to check all current display filters to see whether they are valid or not, which will be tedious!

Any help will be really helpful!

asked 20 Sep '13, 01:49

Ramprasad's gravatar image

Ramprasad
20101115
accept rate: 0%


There is no list of changed filters, at least I don't know one.

You can print the list of fields (usable in the filters) with tshark and run a diff on the output.

tshark -G fields

However, I don't know if tshark 1.2 has this feature. Just try it and you'll see.

If that does not work, you can still run a diff on the source code to see what fields have changed.

Regards
Kurt

permanent link

answered 20 Sep '13, 02:01

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 20 Sep '13, 02:03

That approach was my idea, too, but I didn't remember how to list all the fields. I don't use tshark enough, it seems :-)

(20 Sep '13, 02:28) Jasper ♦♦

I don't use tshark enough, it seems :-)

well, I'm a lot into automation in my projects and tshark is quite useful for some tasks.

But, it's never too late ;-) And you are probably spending some of time on tracewrangler :-)

(20 Sep '13, 03:59) Kurt Knochner ♦

yup, whenever there is time I'm wrangling code :-)

(20 Sep '13, 07:44) Jasper ♦♦

The Wireshark Display Filter Reference page lists all fields and their applicable versions.

And besides tshark -G fields that Kurt mentioned, you can also get that information from Wireshark via: Internals -> Supported Protocols (slow!) -> Display Filter Fields.

permanent link

answered 20 Sep '13, 07:35

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

lists all fields and their applicable versions.

that would be a nice extension for tshark.

(20 Sep '13, 07:39) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×63
×40

question asked: 20 Sep '13, 01:49

question was seen: 1,877 times

last updated: 20 Sep '13, 07:44

p​o​w​e​r​e​d by O​S​Q​A