This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Prevent field to appear in filter text area

0

Im a writing a dissector with a lot of fields, but only some of them are worth filtering.

Is there a way to prevent some fields to appear in the filter text area ?

README.dissector tells tha "The abbreviation is the identifier used in a display filter. If it is an empty string then the field will not be filterable.", but if I use an empty string (""), I get an exception when I start wireshark.

Do you know how to proceed ?

Thank you

asked 29 Apr '16, 09:10

hpa's gravatar image

hpa
16448
accept rate: 0%


One Answer:

1

That version of the docs is out of date; the current master README.dissector says:

The abbreviation is the identifier used in a display filter.  As such it
cannot be an empty string.

In other words, Wireshark's goal/requirement is that all fields are filterable. We shouldn't presume to know what users may want to filter on.

A common example I give here is: yes, it is useful to be able to filter on spare bytes (which are supposed to always be zero): I've repeatedly had to do that myself to find broken implementations (that is, implementations that aren't setting the spares to 0 and other implementations that aren't ignoring those spares).

answered 29 Apr '16, 09:58

JeffMorriss's gravatar image

JeffMorriss ♦
6.2k572
accept rate: 27%

We shouldn't presume to know what users may want to filter on.

And "we" includes all people writing dissectors.

(30 Apr '16, 01:30) Guy Harris ♦♦