 | 1 | initial version |
I think @cmaynard would like the same feature. :-)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10379
==============================================================
Maybe Wireshark could be enhanced to make use of the occurrence specifier in display filters similar to when adding custom columns, perhaps even using the same syntax?
For example: ip.src#1 == 1.2.3.4
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3791
========================================================
Maybe it would be possible to extend the display filters somehow to be able to filter based on something like what tshark provides with its "-Eoccurrence=f|l|a" capabilities? Today, essentially Wireshark filters packets using "-Eoccurrence=a", but if that feature can be added to tshark, then at least in theory it could be added to Wireshark?
This doesn't solve your problem but is a start if you ask for an enhancement.
https://osqa-ask.wireshark.org/questions/56117/if-a-tshark-field-occurs-more-than-once-for-a-single-packet-how-can-i-specify-the-one-do-i-need