Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

I think @cmaynard would like the same feature. :-)
Maybe Wireshark could be enhanced to make use of the occurrence specifier in display filters similar to when adding custom columns, perhaps even using the same syntax?

For example:  ip.src#1 ==
Maybe it would be possible to extend the display filters somehow to be able to filter based on something like what tshark provides with its "-Eoccurrence=f|l|a" capabilities?  Today, essentially Wireshark filters packets using "-Eoccurrence=a", but if that feature can be added to tshark, then at least in theory it could be added to Wireshark?

This doesn't solve your problem but is a start if you ask for an enhancement.