what is the expected value/format for display filter in { }?

asked 2018-10-17 14:33:30 +0000

RobD
1 ●1

I assumed "in" would allow a set of CSV values like tcp.stream in {1,8,12,18} but that results in syntax error.

edit retag flag offensive close merge delete

add a comment

3 Answers

Sort by » oldest newest most voted

answered 2018-10-17 15:33:25 +0000

Jaap

13720 ●684 ●115

See here for the relevant part of the users guide.

edit flag offensive delete link

Comments

Or refer also to The membership operator section of the wireshark-filter man page.

cmaynard ( 2018-10-17 15:40:49 +0000 )edit

add a comment

answered 2018-10-17 14:41:28 +0000

Packet_vlad

1055 ●5 ●75 ●32 http://packettrain.net

tcp.stream in {1 8 12 18} works for me. Not comma separated, but space-separated.

edit flag offensive delete link

Comments

Thank you for the quick response and answer

RobD ( 2018-10-17 14:46:36 +0000 )edit

add a comment

answered 2018-10-17 14:40:25 +0000

jackpcraig

flag of United Kingdom of Great Britain and Northern Ireland

1 ●2 ●2

Hi Rob, try it with spaces instead of commas.

edit flag offensive delete link

Comments

Thanks! wow, been looking at too many packets to consider a space :)

RobD ( 2018-10-17 14:46:10 +0000 )edit

@RobD, Since both answers seem to have resolved your question, please accept one of them using the checkmark so the question is no longer considered, "Unanswered".

cmaynard ( 2018-10-17 15:04:02 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2018-10-17 14:33:30 +0000

Seen: 543 times

Last updated: Oct 17 '18

Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.

what is the expected value/format for display filter in { }? edit

3 Answers

Comments

Comments

Comments