tshark display filter auto suggestion

asked 2018-12-15 12:27:17 +0000

Hi Experts,

In wireshark GUI application - whenever we start typing display filters, we get list of available filters in drop down. This way one doesn't have to remember exact syntax of the filter. Can we get similar functionality in tshark (command line tool ? I couldn't find any relevant reference in this forum. Hence raising this query. Please guide me on forward path. Do I need to raise any feature request for this ?

Regards, Vijay

edit retag flag offensive close merge delete

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2018-12-15 22:12:24 +0000

Jaap

13730 ●684 ●115

Maybe it's possible to generate a bash-completion file for the Bash shell, but given the sheer size of the available display filters I recon that the bash shell script would be prohibitively large and therefore slow.

edit flag offensive delete link

add a comment

answered 2018-12-15 13:51:52 +0000

thetechfirm
96 ●4 ●41 ●16 http://www.thetechfirm...

not sure how they can do that, but you should put a feature request in.

edit flag offensive delete link

Comments

And the place for an enhancement request is our bugzilla.

Note that the OP's request is unlikely to be possible by the Wireshark team as it's the shell that's responsible for command line completion not the application.

grahamb ( 2018-12-15 21:23:51 +0000 )edit

Yes - as Jaap notes, bash supports some level of completion. If it can recognize when what you're completing is in Wireshark filter syntax (an argument to -R, for example), and can invoke an external program, handing it the incomplete filter, and getting back a list of possible completions, we could probably provide a program that does that. It might produce a lot of suggestions, though, as noted.

Guy Harris ( 2018-12-16 04:21:58 +0000 )edit

All : Thanks for recommendations and way forward. I will raise enhancement request so that it can be taken up appropriately

vijay gharge ( 2018-12-16 05:57:56 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

tshark display filter auto suggestion

2 Answers

Comments

Your Answer

Question Tools

Stats

Related questions

tshark display filter auto suggestion edit

2 Answers

Comments

Your Answer

Question Tools

Stats

Related questions

tshark display filter auto suggestion