Is there any way to determine which filter button you have pressed? There doesn't seem to be any indicator that lets you know which saved filter you are using. It would be nice if the button would somehow change color or underline the button text or possible show which button was last pressed in the bottom information bar.
Enhancement requests can be opened on the Wireshark Gitlab Issues website.
I don't see any related to this topic but there is one about supporting filter comments:
19459: FeatureRequest - Display filter enhancements: multiline, comments, pop-out window
If a filter like ip // ip_foo would work for you then upvote or add a comment to that issue.
(For a button labelled ip_foo with a filter of ip)
A duct tape and baling wire fix until then is to use the pkt_comment field in button definition filter:
ip or pkt_comment=="ip_foo"
WSUG: 6.4.3. Combining Expressions
Maybe better with || (Logical OR) ?
Asked: 2025-05-28 15:05:12 +0000
Seen: 19 times
Last updated: yesterday
