Wireshark · Wireshark-dev: [Wireshark-dev] Display filter field variables

Wireshark-dev: [Wireshark-dev] Display filter field variables

From: João Valverde <joao.valverde@xxxxxxxxxxxxxxxxxx>

Date: Fri, 8 Oct 2021 16:09:13 +0100

Hi,

The GUI display filter has an interesting but little-known (?) featureto replace field values for the selected frame with the syntax${<field>}, which I only learned about in bug #15504, and confused me atfirst. This all happens before the expression is compiled and isdifferent from display filter macros.

Does anyone know more about this? And where it is implemented in the GUIcode?

Follow-Ups:
- Re: [Wireshark-dev] Display filter field variables
  - From: chuck c

Prev by Date: [Wireshark-dev] Warning message when starting wireshark "color_filters.c:658 -- read_filters_file(): Could not compile "Checksum Errors" in colorfilters "
Next by Date: Re: [Wireshark-dev] Display filter field variables
Previous by thread: Re: [Wireshark-dev] Warning message when starting wireshark "color_filters.c:658 -- read_filters_file(): Could not compile "Checksum Errors" in colorfilters "
Next by thread: Re: [Wireshark-dev] Display filter field variables
Index(es):
- Date
- Thread