Ask Your Question

Custom column operators

asked 2018-10-06 06:31:07 +0000

felixbkk gravatar image

Can I only use or statements in a custom column? I am wanting to collapse some of the many columns that I have so. One example is for DNS, I'd like to display dns.flags.response if it is a query otherwise display dns.flags.rcode. The problem that I run into with or statement is that for DNS both the request and the reply have a dns.flags.response.

So instead of just using an or statement, can I use other operators?

edit retag flag offensive close merge delete

1 Answer

Sort by » oldest newest most voted

answered 2018-10-08 02:32:38 +0000

Guy Harris gravatar image

No, that's not supported.

What you're asking for would require a syntax different from that used in packet-matching expressions. Packet-matching expressions are expressions that evaluate to a Boolean "matches"/"doesn't match" value; what you want for that example might be something more like a C conditional expression:

dns.flags.response? dns.flags.rcode : dns.flags.response

but that's not supported.

The "or" in custom columns isn't the same "or" as the one in packet-matching expressions; it's just a list separator. It's not as if other packet-matching expression operators would make sense; at best, "and" would mean "show both of the fields if they're both present".

(The choice of packet-matching expression syntax in the fix for bug 9695, which was the feature request for which the feature was introduced, was a mistake.)

You might want to submit an enhancement request on the Wireshark Bugzilla.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2018-10-06 06:31:07 +0000

Seen: 827 times

Last updated: Oct 08 '18