aboutsummaryrefslogtreecommitdiffstats
path: root/doc/wireshark-filter.pod
AgeCommit message (Collapse)AuthorFilesLines
2017-06-22Make "matches" case-insensitive.Gerald Combs1-9/+15
Make the "matches" operator case-insensitive by default. Case sensitivity can be switched back on using "(?-i)". It might be nice to make "contains" case-insensitive as well, but we'd need a caseless version of epan_memmem. Change-Id: I5e39a52c148477c30c808152bcace08348df815a Reviewed-on: https://code.wireshark.org/review/22330 Reviewed-by: Gerald Combs <gerald@wireshark.org> Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-01-22MAN wireshark-filter: Add ~ operatorUli Heilmeier1-4/+4
The tilde (~) operator was missing as an alternative for matches. Bug: 13320 Change-Id: Idb96c802145dcdd0d9ffc196b32370cadd8735b3 Reviewed-on: https://code.wireshark.org/review/19723 Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-09-19Improve support for single-character fields and filter expressions.Guy Harris1-3/+9
Add an FT_CHAR type, which is like FT_UINT8 except that the value is displayed as a C-style character constant. Allow use of C-style character constants in filter expressions; they can be used in comparisons with all integral types, and in "contains" operators. Use that type for some fields that appear (based on the way they're displayed, or on the use of C-style character constants in their value_string tables) to be 1-byte characters rather than 8-bit numbers. Change-Id: I39a9f0dda0bd7f4fa02a9ca8373216206f4d7135 Reviewed-on: https://code.wireshark.org/review/17787 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-09-11dfilter: Add membership operatorJeffrey Smith1-0/+12
Added a new relational test: 'x in {a b c}'. The only LHS entity supported at this time is a field. The generated DFVM operations are equivalent to an OR'ed series of =='s, but with the redundant existence tests removed. Change-Id: Iddc89b81cf7ad6319aef1a2a94f93314cb721a8a Reviewed-on: https://code.wireshark.org/review/10246 Reviewed-by: Hadriel Kaplan <hadrielk@yahoo.com> Petri-Dish: Hadriel Kaplan <hadrielk@yahoo.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-03-10Change a lot of http:// URLs to https://.Gerald Combs1-2/+2
Most of our sites are now HTTPS-only. Update URLs accordingly. Update other URLs while we're at it. Remove or comment out dead links. Change-Id: I7c4f323e6585d22760bb90bf28fc0faa6b893a33 Reviewed-on: https://code.wireshark.org/review/7621 Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Gerald Combs <gerald@wireshark.org>
2014-09-17Update the doc directory to use https://www.wireshark.org.Gerald Combs1-4/+4
Change-Id: I9bfc57cb6b6ab6962b80ff58d98eb351d6f69829 Reviewed-on: https://code.wireshark.org/review/4140 Reviewed-by: Gerald Combs <gerald@wireshark.org>
2013-12-23From Ville Skyttä: Spelling FixesBill Meier1-1/+1
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9591 svn path=/trunk/; revision=54387
2013-06-07Fix all errors and warnings found by podchecker.Chris Maynard1-8/+8
svn path=/trunk/; revision=49837
2012-09-21We are using GRegex in GLib since ~r31304, so stop referencing libpcre. Also,Chris Maynard1-11/+3
fix the perldoc link. Maybe someone else can figure out how to also fix: http contains "http://www.wireshark.org" Either the hyperlink should be made to work correctly by not including the trailing quote as part of the link, or simply change it so it's not hyperlinked at all. Also, it should display a terminating semi-colon as follows: http contains "http://www.wireshark.org"; svn path=/trunk/; revision=45035
2012-06-19Remove what appears to be an errant vi/vim command and add a newline.Gerald Combs1-0/+1
svn path=/trunk/; revision=43371
2012-02-29From Gilbert Ramirez: When filtering on a single-byte byte-array-slice, ↵Anders Broman1-1/+12
using a normal hex string would be nice svn path=/trunk/; revision=41232
2012-02-03The libpcap puts pcap-filter into the misc section (which seems to be 7).Jörg Mayer1-2/+3
Refer to pcap-filter and mention tcpdump only as a fallback. svn path=/trunk/; revision=40820
2011-12-27Add a "-G ftypes" option, which dumps our supprted FT_… names andGerald Combs1-6/+16
descriptions. Captitalize and fix up the descriptions. Use its output to create the field type list in the wireshark-filter man page. svn path=/trunk/; revision=40306
2010-11-30We don't include a comprehensive display filter reference; don't say weGerald Combs1-6/+3
do. svn path=/trunk/; revision=35079
2010-11-09Fixed typos.Chris Maynard1-2/+2
svn path=/trunk/; revision=34816
2010-07-15Don't include the filter list (which is now over 16MB) in theGerald Combs1-0/+417
wireshark-filter man page. Point to other sources for the list instead. svn path=/trunk/; revision=33539
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-16 04:59:06 +0000