This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

how to filter for given set of values

0

how to filter for given set of values Filter Example : bthci_evt.code == 0x03 or bthci_evt.code == 0x05 or bthci_evt.code == 0x01 or bthci_evt.code == 0x04 Which is very long when keep adding with other filter option.

Hence, is there any alternative option for simple filter like: bthci_evt.code in {0x03 or 0x05 or 0x01 or 0x04}

asked 08 Aug '17, 01:49

sghorai's gravatar image

sghorai
11337
accept rate: 100%


3 Answers:

0

Thx.. here is the already available solution that worked and is called Membership Operator:

bthci_evt.code in {0x03 0x05 0x01}

answered 11 Aug '17, 02:29

sghorai's gravatar image

sghorai
11337
accept rate: 100%

edited 11 Aug '17, 02:32

sindy's gravatar image

sindy
6.0k4851

As your post answers your question, I've convered it to an Answer. As it is the correct one, please mark it as a correct answer by clicking the checkmark icon next to it. No one else but the one who has posted the Question can do this.

(11 Aug '17, 02:35) sindy

0

The syntax you look for is not supported in display filters. So your only chance to simplify the filter expression is to use logical operations like bthci_evt.code < 6 and bthci_evt.code != 0 or bthci_evt.code !=2, but that doesn't save you too much typing.

answered 08 Aug '17, 02:31

sindy's gravatar image

sindy
6.0k4851
accept rate: 24%

ok. thx for your information..

(08 Aug '17, 03:52) sghorai

0

Hence, is there any alternative option for simple filter like: bthci_evt.code in {0x03 or 0x05 or 0x01 or 0x04}

No, but that might be a useful extension, so you could submit an enhancement request for that feature on the Wireshark Bugzilla.

answered 08 Aug '17, 12:32

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%