This is our old Q&A Site. Please post any new questions and answers at

I've got an HTTP response that returns some JSON, e.g.:

  id : "1234",
  value1 : "abc",
  value2 : "cheese"

I would like to be able to filter on this. For example, include any responses that have key "value1" in them, or all responses where value2 == "cheese".

I can't find any way to do this using any of the properties of the "json" dissector. Does anyone have any clues here?



asked 23 May '14, 03:15

daern's gravatar image

accept rate: 0%

Currently the JSON dissector doesn't allow matching on member names, only that a json member is present json.member, and any json value, typed as either a unicode string, a number, a true\false value or null, e.g. json.value.string == "cheese".

Usually, if you right click a field in the details pane and click Apply|Prepare as a Filter, then Selected, the filter droplist will show you the appropriate filter. In the case of a json member name it shows a packet specific byte match e.g. frame[227:9] == 22:43:22:3a:22:56:49:53:22 which isn't all that useful.

The json dissector appears to have code commented out that attempts to add a the member name as a filter, not sure what's happening with that though.

permanent link

answered 23 May '14, 04:13

grahamb's gravatar image

grahamb ♦
accept rate: 22%

edited 23 May '14, 04:25

Hi Graham,

Thanks for this. I guess I've stumbled on some work-in-progress ;-)

I might be able to manage this with a packet byte match, which isn't lovely, but at least it might help me.



(23 May '14, 04:17) daern

Remember if the data moves around in the packets, i.e. if the json responses are variable, then the packet byte match won't work.

If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.

(23 May '14, 04:25) grahamb ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 23 May '14, 03:15

question was seen: 18,324 times

last updated: 23 May '14, 04:25

p​o​w​e​r​e​d by O​S​Q​A