Ask Your Question
0

what is the expected value/format for display filter in { }?

asked 2018-10-17 14:33:30 +0000

RobD gravatar image

I assumed "in" would allow a set of CSV values like tcp.stream in {1,8,12,18} but that results in syntax error.

edit retag flag offensive close merge delete
add a comment

3 Answers

Sort by ยป oldest newest most voted
0

answered 2018-10-17 15:33:25 +0000

Jaap gravatar image

See here for the relevant part of the users guide.

edit flag offensive delete link more

Comments

Or refer also to The membership operator section of the wireshark-filter man page.

cmaynard gravatar imagecmaynard ( 2018-10-17 15:40:49 +0000 )edit
add a comment
0

answered 2018-10-17 14:41:28 +0000

Packet_vlad gravatar image

tcp.stream in {1 8 12 18} works for me. Not comma separated, but space-separated.

edit flag offensive delete link more

Comments

Thank you for the quick response and answer

RobD gravatar imageRobD ( 2018-10-17 14:46:36 +0000 )edit
add a comment
0

answered 2018-10-17 14:40:25 +0000

jackpcraig gravatar image

Hi Rob, try it with spaces instead of commas.

edit flag offensive delete link more

Comments

Thanks! wow, been looking at too many packets to consider a space :)

RobD gravatar imageRobD ( 2018-10-17 14:46:10 +0000 )edit

@RobD, Since both answers seem to have resolved your question, please accept one of them using the checkmark so the question is no longer considered, "Unanswered".

cmaynard gravatar imagecmaynard ( 2018-10-17 15:04:02 +0000 )edit
add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

subscribe to rss feed

Stats

Asked: 2018-10-17 14:33:30 +0000

Seen: 727 times

Last updated: Oct 17 '18