I have searched and don't really see the difference between these. I have always used expressions to filter out local machine etc. and had a button. I have been playing with Display filters in the drop down list on the left and have a whole list I gathered that look for certain traffic. asked 13 Sep '16, 14:19 itsme0k edited 13 Sep '16, 14:23 |
2 Answers:
I did a Google search for "display expression" on all wireshark.org sites and found only one reference in a mail message - unlike "display filter", which shows a lot of references. So I'm not sure what a "display expression" is - it doesn't seem to be used, but if by "I have always used expressions to filter out local machine etc." you mean that you've captured traffic and then, in that capture, added a filter that only matched traffic other than local machine traffic, that's the exact same thing as a "display filter". I.e., a display filter is an expression that involves field names, values, comparison and matching operations, and Boolean operators ("and", "or", and "not") to combine multiple such operations. So, in that sense, a "display filter", a "display expression", and a "display filter expression" are all different names for the same thing. answered 13 Sep '16, 19:01 Guy Harris ♦♦ |
The I.e. use of the answered 14 Sep '16, 02:05 sindy |