Can I limit the display filter to an specific occurrence

DisplayFilters

asked 2019-11-19 21:57:57 +0000

Christian_R

2059 ●9 ●71 ●51 http://crnetpackets.com

For example: An IP header inside an ICMP message. In that case we have two IP Headers in one packet.

But can I limit the display filter (e.g. ip.dst) to only one of them, like in the columns dialog?

edit retag flag offensive close merge delete

Comments

Display filter Layers added here: 6759: dfilter: Add syntax to match specific layers in the protocol stack

Discussion of nested (occurrences?) here: [Wireshark-dev] Filter expressions for recursive structures

Chuckc ( 2022-07-30 15:04:05 +0000 )edit

add a comment

1

answered 2019-11-20 12:39:42 +0000

Chuckc
2858 ●5 ●567 ●19

I think @cmaynard would like the same feature. :-)

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10379
==============================================================
Maybe Wireshark could be enhanced to make use of the occurrence specifier in display filters similar to when adding custom columns, perhaps even using the same syntax?

For example:  ip.src#1 == 1.2.3.4

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3791
========================================================
Maybe it would be possible to extend the display filters somehow to be able to filter based on something like what tshark provides with its "-Eoccurrence=f|l|a" capabilities?  Today, essentially Wireshark filters packets using "-Eoccurrence=a", but if that feature can be added to tshark, then at least in theory it could be added to Wireshark?

This doesn't solve your problem but is a start if you ask for an enhancement.
https://osqa-ask.wireshark.org/questi...

edit flag offensive delete link

Comments

@bubbasnmp, the enhancements I proposed in the 2 bug reports you referenced, namely Bug 3791 and Bug 10379, never received any feedback, either positive or negative, so I don't know what the interest level is within the Wireshark community for such an enhancement. It would probably be better if someone interested in such a feature opens a new enhancement bug report specifically requesting this feature to be added; perhaps then it will garner more attention.