Wireshark-users: Re: [Wireshark-users] Case insensitive display filter?

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Gerald Combs <gerald@xxxxxxxxxxxxx>
Date: Mon, 21 Jul 2008 14:22:39 -0700
Ulf Lamping wrote:
> Hi!
> 
> Is there a way to (display) filter out packets case insensitive?
> 
> I mean you can do something like:
> 
>    pn_dcp.suboption_device_nameofstation == "Rack02xF-Device-03"
> || pn_dcp.suboption_device_nameofstation == "rack02xf-device-03"
> 
> But is there a way to do a more generic case insensitive filter, maybe 
> using pcre?

You can use the "lower" function:

    lower(pn_dcp.suboption_device_nameofstation) == "rack02xf-device-03"

or the "i" flag in the PCRE:

    pn_dcp.suboption_device_nameofstation matches "(?i)Rack02xF-Device-03"

If you use the "lower" function, the comparison string must be all lower-case.
With the "matches" operator, it can be mixed case (which I find to be less
error-prone).