This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to define and use alias for custom display filter?

0

Hi I'm using Wireshark with long display filers e.g (wlan_mgt.fixed.status_code == 0x0000) && (wlan.fc.type_subtype == 0x0b) and switch between them many times. Can I define alias for these filters, i.e I enter myfilter1 instead of (wlan_mgt.fixed.status_code == 0x0000) && (wlan.fc.type_subtype == 0x0b)?

asked 10 Apr '17, 00:01

SuBCo's gravatar image

SuBCo
16●2●2●6
accept rate: 0%

edited 10 Apr '17, 00:02

One Answer:

0

Sure, go to Analyze -> Display Filters to get a dialog that allow you to enter filters and give them a meaningful name. Unfortunately, it seems that in the Qt version you can't then apply those filters :-(

answered 10 Apr '17, 03:05

grahamb's gravatar image

grahamb ♦
19.8k●3●30●206
accept rate: 22%

How should i use them? Can I do logical operation with them like: and, or, not

(10 Apr '17, 07:33) SuBCo

I think there's a bug in the GUI, in the old GTK version any selected filter would be used on clicking "OK" on the dialog. You could also click "Apply" to apply the filter and keep the dialog open.

(10 Apr '17, 08:12) grahamb ♦