I use often the display filters with same name but different values. For example, "sip.from.addr contains "12345" || sip.from.addr contains "54321" || sip.from.addr ...". Can I use the form of filter like "sip.from.addr contains "12345" or "54321""? asked 22 May '14, 19:24  factorial |
3 Answers:
No, I don't think so. That's not how the display filter expression syntax works, so if you want to have something like this you'd need to patch it into the Wireshark code yourself. answered 23 May '14, 00:46  Jasper ♦♦ |
Maybe a Display Filter Macro will help? answered 24 May '14, 18:22  cmaynard ♦♦ |
Check out how to use the IN for a set of matching items. https://www.wireshark.org/docs/wsug_html_chunked/ChWorkBuildDisplayFilterSection.html answered 17 Oct '15, 11:07  Sir Launcelot edited 17 Oct '15, 12:09  joke |
