diff options
| author | João Valverde <j@v6e.pt> | 2021-10-29 18:37:05 +0100 |
|---|---|---|
| committer | João Valverde <j@v6e.pt> | 2021-10-31 09:28:24 +0000 |
| commit | 6ae0044ebeacb158e40a96cdcd34cd7588d3556e (patch) | |
| tree | a4f7de2a21b54054980289cdfec5ce88c1260bf3 | |
| parent | f78ebe1564bd34976cc9d22d4925721d8044971b (diff) | |
docs: Update documentation to use ',' as set separator
| -rw-r--r-- | dfilters | 2 | ||||
| -rw-r--r-- | docbook/wsug_src/WSUG_chapter_work.adoc | 15 |
2 files changed, 9 insertions, 8 deletions
@@ -13,4 +13,4 @@ "TCP or UDP port is 80 (HTTP)" tcp.port == 80 || udp.port == 80 "HTTP" http "No ARP and no DNS" not arp and !(udp.port == 53) -"Non-HTTP and non-SMTP to/from 192.0.2.1" ip.addr == 192.0.2.1 and not tcp.port in {80 25} +"Non-HTTP and non-SMTP to/from 192.0.2.1" ip.addr == 192.0.2.1 and tcp.port not in {80, 25} diff --git a/docbook/wsug_src/WSUG_chapter_work.adoc b/docbook/wsug_src/WSUG_chapter_work.adoc index 50c63b8bc4..9dc613e1f4 100644 --- a/docbook/wsug_src/WSUG_chapter_work.adoc +++ b/docbook/wsug_src/WSUG_chapter_work.adoc @@ -681,7 +681,7 @@ You can combine filter expressions in Wireshark using the logical operators show |xor |^^ | Logical XOR | `tr.dst[0:3] == 0.6.29 xor tr.src[0:3] == 0.6.29` |not |! | Logical NOT | `not llc` |[...] | | Subsequence | See “Slice Operator” below. -|in | | Set Membership| http.request.method in {"HEAD" "GET"}. See “Membership Operator” below. +|in | | Set Membership| http.request.method in {"HEAD", "GET"}. See “Membership Operator” below. |=== ==== Slice Operator @@ -724,14 +724,15 @@ to form compound ranges as shown above. Wireshark allows you to test a field for membership in a set of values or fields. After the field name, use the `in` operator followed by the set items surrounded by braces {}. For example, to display packets with a TCP source or -destination port of 80, 443, or 8080, you can use `tcp.port in {80 443 8080}`. -The set of values can also contain ranges: `tcp.port in {443 4430..4434}`. +destination port of 80, 443, or 8080, you can use `tcp.port in {80, 443, 8080}`. +Set elements must be separated by commas. +The set of values can also contain ranges: `tcp.port in {443,4430..4434}`. [NOTE] ==== The display filter ---- -tcp.port in {80 443 8080} +tcp.port in {80, 443, 8080} ---- is equivalent to ---- @@ -739,7 +740,7 @@ tcp.port == 80 || tcp.port == 443 || tcp.port == 8080 ---- However, the display filter ---- -tcp.port in {443 4430..4434} +tcp.port in {443, 4430..4434} ---- is not equivalent to ---- @@ -756,8 +757,8 @@ membership operator tests a single field against the range condition. Sets are not just limited to numbers, other types can be used as well: ---- -http.request.method in {"HEAD" "GET"} -ip.addr in {10.0.0.5 .. 10.0.0.9 192.168.1.1..192.168.1.9} +http.request.method in {"HEAD", "GET"} +ip.addr in {10.0.0.5 .. 10.0.0.9, 192.168.1.1..192.168.1.9} frame.time_delta in {10 .. 10.5} ---- |