This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I use often the display filters with same name but different values. For example, "sip.from.addr contains "12345" || sip.from.addr contains "54321" || sip.from.addr ...". Can I use the form of filter like "sip.from.addr contains "12345" or "54321""?

asked 22 May '14, 19:24

factorial's gravatar image

factorial
26448
accept rate: 0%


No, I don't think so. That's not how the display filter expression syntax works, so if you want to have something like this you'd need to patch it into the Wireshark code yourself.

permanent link

answered 23 May '14, 00:46

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Maybe a Display Filter Macro will help?

permanent link

answered 24 May '14, 18:22

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

Check out how to use the IN for a set of matching items.

https://www.wireshark.org/docs/wsug_html_chunked/ChWorkBuildDisplayFilterSection.html

permanent link

answered 17 Oct '15, 11:07

Sir%20Launcelot's gravatar image

Sir Launcelot
6112
accept rate: 0%

edited 17 Oct '15, 12:09

joke's gravatar image

joke
1.3k4934

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×349
×63
×24
×2

question asked: 22 May '14, 19:24

question was seen: 1,852 times

last updated: 17 Oct '15, 12:09

p​o​w​e​r​e​d by O​S​Q​A