Wireshark-dev: Re: [Wireshark-dev] Display filter using wildcards

From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Fri, 07 Sep 2012 08:53:46 +0200
Hi,

Have a look in epan/dfilter/. There's the grammar.lemon and scanner.l(ex) that do the work.

Thanks,
Jaap

On 09/07/2012 04:55 AM, Ken Sarmago wrote:
Hi all,

I'm new to this list. First of all, kudos to all wireshark developers for a
great tool.

I've been trying to create a Display filter for address fields using wildcards '*'.
e.g.
of.match_dl_dst == 10:00:12:34:56:*
of.match_dl_dst == 10:00:12:34:*:*
of.match_dl_dst == 10:00:12:*:*:*
of.match_dl_dst == 10:00:*:*:*:*
of.match_dl_dst == 10:00:*:*:56:78

Has anyone done this before?

I know there are other filter expressions that can serve the same purpose, but
what if I really want to use wildcards '*'.

If I were to modify wireshark filter function, were will I start?

Thanks a lot in advance,
Ken