This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Display filter in a short format

0

I use often the display filters with same name but different values. For example, "sip.from.addr contains "12345" || sip.from.addr contains "54321" || sip.from.addr ...". Can I use the form of filter like "sip.from.addr contains "12345" or "54321""?

asked 22 May '14, 19:24

factorial's gravatar image

factorial
26448
accept rate: 0%


3 Answers:

0

No, I don't think so. That's not how the display filter expression syntax works, so if you want to have something like this you'd need to patch it into the Wireshark code yourself.

answered 23 May '14, 00:46

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

0

Maybe a Display Filter Macro will help?

answered 24 May '14, 18:22

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

0

answered 17 Oct '15, 11:07

Sir%20Launcelot's gravatar image

Sir Launcelot
6112
accept rate: 0%

edited 17 Oct '15, 12:09

joke's gravatar image

joke
1.3k4934