This is our old Q&A Site. Please post any new questions and answers at

I use often the display filters with same name but different values. For example, "sip.from.addr contains "12345" || sip.from.addr contains "54321" || sip.from.addr ...". Can I use the form of filter like "sip.from.addr contains "12345" or "54321""?

asked 22 May '14, 19:24

factorial's gravatar image

accept rate: 0%

No, I don't think so. That's not how the display filter expression syntax works, so if you want to have something like this you'd need to patch it into the Wireshark code yourself.

permanent link

answered 23 May '14, 00:46

Jasper's gravatar image

Jasper ♦♦
accept rate: 18%

Maybe a Display Filter Macro will help?

permanent link

answered 24 May '14, 18:22

cmaynard's gravatar image

cmaynard ♦♦
accept rate: 20%

Check out how to use the IN for a set of matching items.

permanent link

answered 17 Oct '15, 11:07

Sir%20Launcelot's gravatar image

Sir Launcelot
accept rate: 0%

edited 17 Oct '15, 12:09

joke's gravatar image


Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 22 May '14, 19:24

question was seen: 1,923 times

last updated: 17 Oct '15, 12:09

p​o​w​e​r​e​d by O​S​Q​A