This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

managing Filters inside Profile Preferences files

0

I want to more effectively manage Filters defined within Profiles.

By that, I mean that each of my Profiles tends to contain the same basic set of Filters, plus a bunch which are unique to that Profile, and that I occasionally want to update that common set.

Specifically, %APPDATA%\Wireshark\profiles{name of profile}\preferences contains a section which looks like this:

# Filter Expressions

gui.filter_expressions.label: Me gui.filter_expressions.enabled: TRUE gui.filter_expressions.expr: eth.addr==80:EE:73:43:D6:9C gui.filter_expressions.label: Not Broadcast gui.filter_expressions.enabled: TRUE gui.filter_expressions.expr: not eth.ig==1 gui.filter_expressions.label: Not-Junk gui.filter_expressions.enabled: TRUE gui.filter_expressions.expr: not (browser or db-lsp-disc or ipv6 or ip.dst==224.0.0.0/8 or hsrp or ipx or nbns or rtmp or stp) gui.filter_expressions.label: TAF gui.filter_expressions.enabled: TRUE gui.filter_expressions.expr: (tcp.analysis.flags and not tcp.analysis.window_update) or tcp.flags.reset==1 gui.filter_expressions.label: TCP Reset gui.filter_expressions.enabled: TRUE gui.filter_expressions.expr: tcp.flags.reset==1

When I copy my Profile collection to a new machine (which happens more frequently than I'm enjoying), I manually edit each preferences file and change '80:EE:73:43:D6:9C' to the MAC address of my new workstation. Tedious.

In a perfect world, I would paste this block of 'common' filters into %APPDATA%\Roaming\Wireshark\preferences or perhaps preferences_common; then, they would magically appear in every single Profile ... and life would be good. But, we don't yet have a concept of a 'common' preferences file, per https://www.wireshark.org/lists/wireshark-users/201306/msg00041.html [The approach I'm imagining would also make it easy to add a new filter to every single Profile ... or to update the 'Not Junk' filter, the elements of which are gradually increasing as I encounter more and more 'junk' in my environments ... both currently manual / tedious tasks.]

So I'm headed toward writing a Windows .bat file and a *nix bash script to at least automate replacing '80:EE:73:43:D6:9C' with the MAC address of my new workstation. A little directory traversal, a sed one-liner, not too difficult.

But before I walk this path, I want to float this problem here, figuring that other folks face it too. Has anyone tumbled to a more clever solution than the one I'm envisioning?

--sk

asked 08 Jan '15, 06:42

skendric's gravatar image

skendric
11111113
accept rate: 0%


One Answer:

0

Has anyone tumbled to a more clever solution than the one I'm envisioning?
eth.addr==80:EE:73:43:D6:9C gui.filter_expressions.label: Not Broadcast

Instead of rewriting your MAC address, you could use the following, common filter, to remove ethernet broadcasts

!eth.addr==FF:FF:FF:FF:FF:FF

This will however only filter broadcast MAC addresses, not multicast MAC addresses, but maybe that's O.K. for your environment.

Unfortunately the following filter does not work to remove the most common multicast MAC addresses.

! eth.addr matches "^(01|33)"

Whereas the following filter returns the correct frames!?!

eth.addr matches "^33"

However not this filter!

eth.addr matches "^01"

So, either the "matches" operator is either buggy when applied to eth.addr fields, or it works differently than I would have expected.

Regards
Kurt

answered 10 Jan '15, 05:51

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%