Ask Your Question

tshark display filter auto suggestion

asked 2018-12-15 12:27:17 +0000

vijay gharge gravatar image

Hi Experts,

In wireshark GUI application - whenever we start typing display filters, we get list of available filters in drop down. This way one doesn't have to remember exact syntax of the filter. Can we get similar functionality in tshark (command line tool ? I couldn't find any relevant reference in this forum. Hence raising this query. Please guide me on forward path. Do I need to raise any feature request for this ?

Regards, Vijay

edit retag flag offensive close merge delete

2 Answers

Sort by ยป oldest newest most voted

answered 2018-12-15 22:12:24 +0000

Jaap gravatar image

Maybe it's possible to generate a bash-completion file for the Bash shell, but given the sheer size of the available display filters I recon that the bash shell script would be prohibitively large and therefore slow.

edit flag offensive delete link more

answered 2018-12-15 13:51:52 +0000

not sure how they can do that, but you should put a feature request in.

edit flag offensive delete link more


And the place for an enhancement request is our bugzilla.

Note that the OP's request is unlikely to be possible by the Wireshark team as it's the shell that's responsible for command line completion not the application.

grahamb gravatar imagegrahamb ( 2018-12-15 21:23:51 +0000 )edit

Yes - as Jaap notes, bash supports some level of completion. If it can recognize when what you're completing is in Wireshark filter syntax (an argument to -R, for example), and can invoke an external program, handing it the incomplete filter, and getting back a list of possible completions, we could probably provide a program that does that. It might produce a lot of suggestions, though, as noted.

Guy Harris gravatar imageGuy Harris ( 2018-12-16 04:21:58 +0000 )edit

All : Thanks for recommendations and way forward. I will raise enhancement request so that it can be taken up appropriately

vijay gharge gravatar imagevijay gharge ( 2018-12-16 05:57:56 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2018-12-15 12:27:17 +0000

Seen: 209 times

Last updated: Dec 15 '18