aboutsummaryrefslogtreecommitdiffstats
path: root/doc/wireshark-filter.pod
AgeCommit message (Collapse)AuthorFilesLines
2019-04-21wireshark-filter: clarifications and update links in manualPeter Wu1-5/+8
Clarify *display* filter, add link to User's Guide, and update to https. Change-Id: I9a2152213cf5b4cb3daf15e62c73074524d92f94 Reviewed-on: https://code.wireshark.org/review/32912 Petri-Dish: Anders Broman <a.broman58@gmail.com> Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2019-01-14dfilter: add string() function.Dario Lombardo1-0/+10
This function can convert non-string fields into strings. This allows the user to apply string functions (like contains and matches) to non-string fields. Examples: string(frame.number) matches "[13579]$" => for odd frames string(eth.dst) matches "aa\.bb\.cc\.dd\.ee\..." => to match a group of stations string(snmp.name) matches "^1.2.3.4" => for all OIDs under a specific node Change-Id: I18173f50ba5314ecdcd1e4b66c7e8ba5b44257ee Reviewed-on: https://code.wireshark.org/review/31427 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Peter Wu <peter@lekensteyn.nl>
2019-01-05doc: remove wrong trailing slash.Dario Lombardo1-1/+1
Change-Id: If6bcf2ce9754453cfff434dde67b682761b37231 Reviewed-on: https://code.wireshark.org/review/31394 Petri-Dish: Dario Lombardo <lomato@gmail.com> Tested-by: Petri Dish Buildbot Reviewed-by: Guy Harris <guy@alum.mit.edu>
2018-08-18Docs: Make our Pod documentation encoding uniform.Gerald Combs1-0/+5
We've set "=encoding utf8" in wireshark.pod for a long time. Do so in the rest of our .pod files. Change-Id: I3ef0fb3a88ed63275b4ff4362b6afbf13d79a0bc Reviewed-on: https://code.wireshark.org/review/29182 Reviewed-by: Gerald Combs <gerald@wireshark.org> Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2018-04-25Document "len" and "count" in wireshark-filter(4) and WSUGPeter Wu1-0/+2
Add missing section on display filter functions to WSUG and make it consistent with the wireshark-filter(4) manual. "count" was added in Wireshark 1.12 (bug 9480). "len" was added in Wireshark 1.6.x. "size" (added in 1.8.x) is not documented since it works like "len", except that it is not limited to strings and byte arrays. I think that "len" should be extended to other types while removing "size". Change-Id: I2c8e2b4a11f007de7852a797bed971af86840b47 Reviewed-on: https://code.wireshark.org/review/27146 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-04-18dfilter: make spaces around ".." optional in display filterPeter Wu1-2/+2
For numeric values such as port numbers, "4430..4434" looks more natural than "4430 .. 4434", so support that. To make this possible, the display filter syntax needs to be restricted. Assume that neither field names nor values can contain "..". The display filter `data contains ..` will now be considered a syntax error and must be written as `data contains ".."` instead. More generally, all values that contain ".." must be quoted. Other than the ".." restriction, the scanner deliberately accepts more characters that can potentially form invalid input. This is to prevent accidentally splitting input in multiple tokens. For example, "9.2." in "frame.time_delta in {9.2.}" is currently parsed as one token and then rejected because it cannot be parsed as time. If the scanner was made stricter, it could treat it as two tokens (floats), "9." and "2." which has different meaning for the set membership operator. An unhandled edge case is "1....2" which is parsed as "1 .. .. 2" but could have been parsed as "1. .. .2" instead. A float with trailing dots followed by ".." seems sufficiently weird, so rejection is fine. Ping-Bug: 14180 Change-Id: Ibad8e851b49346c9d470f09d5d6a54defa21bcb9 Reviewed-on: https://code.wireshark.org/review/26960 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2018-04-18dfilter: add range support to set membership operator ("f in {x .. y}")Peter Wu1-0/+10
Allow "tcp.srcport in {1662 1663 1664}" to be abbreviated to "tcp.srcport in {1662 .. 1664}". The range operator is supported for any field value which supports the "<=" and "=>" operators and thus works for integers, IP addresses, etc. The naive mapping "tcp.srcport >= 1662 and tcp.srcport <= 1664" is not used because it does not have the intended effect with fields that have multiple occurrences (e.g. tcp.port). Each condition could be satisfied by an other value. Therefore a new DVFM instruction (ANY_IN_RANGE) is added to test the range condition against each individual field value. Bug: 14180 Change-Id: I53c2d0f9bc9d4f0ffaabde9a83442122965c95f7 Reviewed-on: https://code.wireshark.org/review/26945 Petri-Dish: Peter Wu <peter@lekensteyn.nl> Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-06-22Make "matches" case-insensitive.Gerald Combs1-9/+15
Make the "matches" operator case-insensitive by default. Case sensitivity can be switched back on using "(?-i)". It might be nice to make "contains" case-insensitive as well, but we'd need a caseless version of epan_memmem. Change-Id: I5e39a52c148477c30c808152bcace08348df815a Reviewed-on: https://code.wireshark.org/review/22330 Reviewed-by: Gerald Combs <gerald@wireshark.org> Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Anders Broman <a.broman58@gmail.com>
2017-01-22MAN wireshark-filter: Add ~ operatorUli Heilmeier1-4/+4
The tilde (~) operator was missing as an alternative for matches. Bug: 13320 Change-Id: Idb96c802145dcdd0d9ffc196b32370cadd8735b3 Reviewed-on: https://code.wireshark.org/review/19723 Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-09-19Improve support for single-character fields and filter expressions.Guy Harris1-3/+9
Add an FT_CHAR type, which is like FT_UINT8 except that the value is displayed as a C-style character constant. Allow use of C-style character constants in filter expressions; they can be used in comparisons with all integral types, and in "contains" operators. Use that type for some fields that appear (based on the way they're displayed, or on the use of C-style character constants in their value_string tables) to be 1-byte characters rather than 8-bit numbers. Change-Id: I39a9f0dda0bd7f4fa02a9ca8373216206f4d7135 Reviewed-on: https://code.wireshark.org/review/17787 Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-09-11dfilter: Add membership operatorJeffrey Smith1-0/+12
Added a new relational test: 'x in {a b c}'. The only LHS entity supported at this time is a field. The generated DFVM operations are equivalent to an OR'ed series of =='s, but with the redundant existence tests removed. Change-Id: Iddc89b81cf7ad6319aef1a2a94f93314cb721a8a Reviewed-on: https://code.wireshark.org/review/10246 Reviewed-by: Hadriel Kaplan <hadrielk@yahoo.com> Petri-Dish: Hadriel Kaplan <hadrielk@yahoo.com> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Michael Mann <mmann78@netscape.net>
2015-03-10Change a lot of http:// URLs to https://.Gerald Combs1-2/+2
Most of our sites are now HTTPS-only. Update URLs accordingly. Update other URLs while we're at it. Remove or comment out dead links. Change-Id: I7c4f323e6585d22760bb90bf28fc0faa6b893a33 Reviewed-on: https://code.wireshark.org/review/7621 Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Gerald Combs <gerald@wireshark.org>
2014-09-17Update the doc directory to use https://www.wireshark.org.Gerald Combs1-4/+4
Change-Id: I9bfc57cb6b6ab6962b80ff58d98eb351d6f69829 Reviewed-on: https://code.wireshark.org/review/4140 Reviewed-by: Gerald Combs <gerald@wireshark.org>
2013-12-23From Ville Skyttä: Spelling FixesBill Meier1-1/+1
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9591 svn path=/trunk/; revision=54387
2013-06-07Fix all errors and warnings found by podchecker.Chris Maynard1-8/+8
svn path=/trunk/; revision=49837
2012-09-21We are using GRegex in GLib since ~r31304, so stop referencing libpcre. Also,Chris Maynard1-11/+3
fix the perldoc link. Maybe someone else can figure out how to also fix: http contains "http://www.wireshark.org" Either the hyperlink should be made to work correctly by not including the trailing quote as part of the link, or simply change it so it's not hyperlinked at all. Also, it should display a terminating semi-colon as follows: http contains "http://www.wireshark.org"; svn path=/trunk/; revision=45035
2012-06-19Remove what appears to be an errant vi/vim command and add a newline.Gerald Combs1-0/+1
svn path=/trunk/; revision=43371
2012-02-29From Gilbert Ramirez: When filtering on a single-byte byte-array-slice, ↵Anders Broman1-1/+12
using a normal hex string would be nice svn path=/trunk/; revision=41232
2012-02-03The libpcap puts pcap-filter into the misc section (which seems to be 7).Jörg Mayer1-2/+3
Refer to pcap-filter and mention tcpdump only as a fallback. svn path=/trunk/; revision=40820
2011-12-27Add a "-G ftypes" option, which dumps our supprted FT_… names andGerald Combs1-6/+16
descriptions. Captitalize and fix up the descriptions. Use its output to create the field type list in the wireshark-filter man page. svn path=/trunk/; revision=40306
2010-11-30We don't include a comprehensive display filter reference; don't say weGerald Combs1-6/+3
do. svn path=/trunk/; revision=35079
2010-11-09Fixed typos.Chris Maynard1-2/+2
svn path=/trunk/; revision=34816
2010-07-15Don't include the filter list (which is now over 16MB) in theGerald Combs1-0/+417
wireshark-filter man page. Point to other sources for the list instead. svn path=/trunk/; revision=33539
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-26 02:15:36 +0000