This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Difference between Display filter and Display expresions

0

I have searched and don't really see the difference between these. I have always used expressions to filter out local machine etc. and had a button. I have been playing with Display filters in the drop down list on the left and have a whole list I gathered that look for certain traffic.

asked 13 Sep '16, 14:19

itsme0k's gravatar image

itsme0k
6557
accept rate: 0%

edited 13 Sep '16, 14:23


2 Answers:

0

I did a Google search for "display expression" on all wireshark.org sites and found only one reference in a mail message - unlike "display filter", which shows a lot of references.

So I'm not sure what a "display expression" is - it doesn't seem to be used, but if by "I have always used expressions to filter out local machine etc." you mean that you've captured traffic and then, in that capture, added a filter that only matched traffic other than local machine traffic, that's the exact same thing as a "display filter". I.e., a display filter is an expression that involves field names, values, comparison and matching operations, and Boolean operators ("and", "or", and "not") to combine multiple such operations.

So, in that sense, a "display filter", a "display expression", and a "display filter expression" are all different names for the same thing.

answered 13 Sep '16, 19:01

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

0

The Expression button next to the display filter field opens a tool assisting you in putting together display filter primitives which you may use to create more complex display filter expressions. To compose a display filter primitive using this tool, you first select the protocol (meta)field from a tree containing all available fields provided by all active dissectors. By choosing a field, you get a list of comparison operators available for the chosen field which depends on field type and properties, and a list of possible values to compare with if a fixed list of values exists for the chosen field.

I.e. use of the Expression button is yet another way how to compose a display filter (which is, in this context, a common abbreviation of the precise term "display filter expression" - you may "use" a display filter but you describe the behaviour of that filter using an expression which consists of one or more primitives), the others being freehand typing and use of the dissection pane's context menu items like Apply as Filter and Prepare as Filter.

answered 14 Sep '16, 02:05

sindy's gravatar image

sindy
6.0k4851
accept rate: 24%