Revision history [back]

Maybe a pre-processing step with tshark then store them as Display Filter Macros.

p$ TARGET="crypt"
p$ tshark -r ./rsa_decrypt.pcapng -T pdml | grep "field name" | cut -f 2 -d '"' | grep $TARGET | sort | uniq | awk '{print'} ORS=' or '
x509af.encrypted or p$

p$ TARGET="connection"
p$ tshark -r ./rsa_decrypt.pcapng -T pdml | grep "field name" | cut -f 2 -d '"' | grep $TARGET | sort | uniq | awk '{print'} ORS=' or '
tcp.connection.syn or tcp.connection.synack or p$

Maybe a pre-processing step with tshark then store them as Display Filter Macros.
You could also open an Enhancement Request on the Wireshark Gitlab Issues page.

p$ TARGET="crypt"
p$ tshark -r ./rsa_decrypt.pcapng -T pdml | grep "field name" | cut -f 2 -d '"' | grep $TARGET | sort | uniq | awk '{print'} ORS=' or '
x509af.encrypted or p$

p$ TARGET="connection"
p$ tshark -r ./rsa_decrypt.pcapng -T pdml | grep "field name" | cut -f 2 -d '"' | grep $TARGET | sort | uniq | awk '{print'} ORS=' or '
tcp.connection.syn or tcp.connection.synack or p$