From 80322d88da92969c170c915e93a33a96e12497a7 Mon Sep 17 00:00:00 2001 From: Jeffrey Smith Date: Tue, 18 Aug 2015 22:03:41 -0500 Subject: dfilter: Add membership operator Added a new relational test: 'x in {a b c}'. The only LHS entity supported at this time is a field. The generated DFVM operations are equivalent to an OR'ed series of =='s, but with the redundant existence tests removed. Change-Id: Iddc89b81cf7ad6319aef1a2a94f93314cb721a8a Reviewed-on: https://code.wireshark.org/review/10246 Reviewed-by: Hadriel Kaplan Petri-Dish: Hadriel Kaplan Tested-by: Petri Dish Buildbot Reviewed-by: Michael Mann --- docbook/wsug_src/WSUG_chapter_work.asciidoc | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'docbook/wsug_src') diff --git a/docbook/wsug_src/WSUG_chapter_work.asciidoc b/docbook/wsug_src/WSUG_chapter_work.asciidoc index ecce012c29..42a88657ed 100644 --- a/docbook/wsug_src/WSUG_chapter_work.asciidoc +++ b/docbook/wsug_src/WSUG_chapter_work.asciidoc @@ -386,6 +386,19 @@ Wireshark allows you to string together single ranges in a comma separated list to form compound ranges as shown above. |=============== +==== Membership Operator. +Wireshark allows you to test a field for membership in a set of values or +fields. After the field name, use the in operator followed by the set items +surrounded by braces {}. +---- +tcp.port in {80 443 8080} +---- +This can be considered a shortcut operator, as the previous expression could +have been expressed as: +---- +tcp.port == 80 || tcp.port == 443 || tcp.port == 8080 +---- + [[ChWorkBuildDisplayFilterMistake]] ==== A common mistake -- cgit v1.2.3