["Chris Hines" <chines@xxxxxxxxxxxxxxxxxxxxxx>]

Another option would be to apply your first filter, then Save As and choose "Displayed". 


CH

-----Original Message-----
From: wireshark-users-bounces@xxxxxxxxxxxxx [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of wireshark-users-request@xxxxxxxxxxxxx
Sent: Thursday, November 01, 2007 5:00 AM
To: wireshark-users@xxxxxxxxxxxxx
Subject: Wireshark-users Digest, Vol 18, Issue 1

Send Wireshark-users mailing list submissions to
	wireshark-users@xxxxxxxxxxxxx

To subscribe or unsubscribe via the World Wide Web, visit
	http://www.wireshark.org/mailman/listinfo/wireshark-users
or, via email, send a message with subject or body 'help' to
	wireshark-users-request@xxxxxxxxxxxxx

You can reach the person managing the list at
	wireshark-users-owner@xxxxxxxxxxxxx

When replying, please edit your Subject line so it is more specific
than "Re: Contents of Wireshark-users digest..."


Today's Topics:

   1. Applying Multiple Display Filters (NLC)
   2. Re: Applying Multiple Display Filters (Guy Harris)


----------------------------------------------------------------------

Message: 1
Date: Wed, 31 Oct 2007 13:53:19 -0700 (PDT)
From: NLC <nlcny@xxxxxxxxx>
Subject: [Wireshark-users] Applying Multiple Display Filters
To: wireshark-users@xxxxxxxxxxxxx
Message-ID: <828489.90001.qm@xxxxxxxxxxxxxxxxxxxxxxxxxxx>
Content-Type: text/plain; charset="iso-8859-1"

Hi All,

Is there an easy way to apply multiple display filters under Wireshark?

I want to be able to loadup a capture, apply a filter and look at the packets and further narrow it down by applying another without losing the first filter. I know I can AND it but the filter gets pretty long.

Thanks.
 __________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.wireshark.org/lists/wireshark-users/attachments/20071031/ace36e2e/attachment.html 

------------------------------

Message: 2
Date: Wed, 31 Oct 2007 15:01:07 -0700
From: Guy Harris <guy@xxxxxxxxxxxx>
Subject: Re: [Wireshark-users] Applying Multiple Display Filters
To: Community support list for Wireshark
	<wireshark-users@xxxxxxxxxxxxx>
Message-ID: <F66ED41E-8BD4-4BFA-9A36-E80D4D88B158@xxxxxxxxxxxx>
Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes


On Oct 31, 2007, at 1:53 PM, NLC wrote:

> Is there an easy way to apply multiple display filters under  
> Wireshark?
>
> I want to be able to loadup a capture, apply a filter and look at  
> the packets and further narrow it down by applying another without  
> losing the first filter. I know I can AND it but the filter gets  
> pretty long.

No, there isn't - the only way to do that is with an AND (and if we  
ever provided anything such as that, we'd probably implement it  
internally as an AND).


------------------------------

_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-users


End of Wireshark-users Digest, Vol 18, Issue 1
**********************************************