Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

Is there a way to write a display filter macro to define a variable for multiple IP addresses?

I am attempting to write a macro that acts as a variable for multiple IP address. Something similar to the following: (Found this as an example on wireshark.org)

Name: private_ipv4 Text: $1 == 192.168.0.0/16 or $1 == 172.16.0.0/12 or $1 == 10.0.0.0/8

This format fails with the error "wrong number of arguments for macro 'private_ipv4', expecting 1 instead of 0. I want to be able to call a variable in a filter instead of typing out all of the IP addresses.