Can I only use or statements in a custom column? I am wanting to collapse some of the many columns that I have so. One example is for DNS, I'd like to display dns.flags.response if it is a query otherwise display dns.flags.rcode. The problem that I run into with or statement is that for DNS both the request and the reply have a dns.flags.response.
So instead of just using an or statement, can I use other operators?
No, that's not supported.
What you're asking for would require a syntax different from that used in packet-matching expressions. Packet-matching expressions are expressions that evaluate to a Boolean "matches"/"doesn't match" value; what you want for that example might be something more like a C conditional expression:
dns.flags.response? dns.flags.rcode : dns.flags.response
but that's not supported.
The "or" in custom columns isn't the same "or" as the one in packet-matching expressions; it's just a list separator. It's not as if other packet-matching expression operators would make sense; at best, "and" would mean "show both of the fields if they're both present".
(The choice of packet-matching expression syntax in the fix for bug 9695, which was the feature request for which the feature was introduced, was a mistake.)
You might want to submit an enhancement request on the Wireshark Bugzilla.
Asked: 2018-10-06 06:31:07 +0000
Seen: 935 times
Last updated: Oct 08 '18