If you already have a display filter applied and want to add more filters on to the results to narrow down the results, you could use one of the latter options from the "Apply as Filter" sub-menu from the Packet Details context menu.
For example, in the attached screenshots, the display filter "tcp.stream eq 0" was already applied. I then chose to apply another filter onto that to narrow down the results further.
HTH
Abhik.
On Tue, Oct 2, 2012 at 6:24 PM, FS
<bastiji@xxxxxxxxx> wrote:
Folks - My sincere thanks for a wonderful product which has saved the day for me many times. There's one thing I haven't been able to do so far and I thought asking the knowledgeable folks here might be a good idea. I did try googling without any luck.
The workflow of using wireshark, for me at least, is to open a capture, focus in on a conversation and then try and use further filters to get the information I'm looking for. Is there a way to launch a separate Wireshark window instance with the results of the display filter, so within the new window I can use further display filters to get the data I want. Currently if the display filter doesn't show what I want, then I have to clear the filter completely and re-type (or paste depending on circumstance) the filters again and start afresh.
I know I can save the displayed packets as a separate capture, and then open it up, but hoping there is another better way to do it.
Any help appreciated!
Thanks,
Basti Ji
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
Attachment:
Display filter.pdf
Description: Adobe PDF document