osmith
/
wireshark
forked from osmocom/wireshark
1
0
Fork 0
Code Pull Requests Releases Wiki Activity

WSUG: Document the layer operator. 

Copy over the "layer operator" section from the wireshark-filter man
page.

Fix the "at operator" level in the wireshark-filter man page.
This commit is contained in:
Gerald Combs 2022-11-03 11:12:27 +00:00
parent 1505fa1b4b
commit 5084857eed
2 changed files with 20 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
doc/wireshark-filter.adoc
View File

@ -388,7 +388,7 @@ For more complicated ranges the same syntax used with slices is valid:
means layers number 2, 3 or 4 inclusive. The hash symbol is required to means layers number 2, 3 or 4 inclusive. The hash symbol is required to
distinguish a layer range from a slice. distinguish a layer range from a slice.
== The at operator === The at operator
By prefixing the field name with an at sign (@) the comparison is done against By prefixing the field name with an at sign (@) the comparison is done against
the raw packet data for the field. the raw packet data for the field.

20
docbook/wsug_src/WSUG_chapter_work.adoc
View File

@ -762,6 +762,24 @@ eth.src[0:3,1-2,:4,4:,2] ==
Wireshark allows you to string together single ranges in a comma separated list Wireshark allows you to string together single ranges in a comma separated list
to form compound ranges as shown above. to form compound ranges as shown above.
==== The Layer Operator
A field can be restricted to a certain layer in the protocol stack using the
layer operator (#), followed by a decimal number:
ip.addr#2 == 192.168.30.40
matches only the inner (second) layer in the packet.
Layers use simple stacking semantics and protocol layers are counted sequentially starting from 1.
For example, in a packet that contains two IPv4 headers, the outer (first) source address can be matched with "ip.src#1" and the inner (second) source address can be matched with "ip.src#2".
For more complicated ranges the same syntax used with slices is valid:
tcp.port#[2-4]
means layers number 2, 3 or 4 inclusive. The hash symbol is required to
distinguish a layer range from a slice.
==== Membership Operator ==== Membership Operator
Wireshark allows you to test a field for membership in a set of values or Wireshark allows you to test a field for membership in a set of values or
fields. After the field name, use the `in` operator followed by the set items fields. After the field name, use the `in` operator followed by the set items
@ -920,7 +938,7 @@ How ambiguous values are interpreted may change in the future. To avoid this
problem and resolve the ambiguity there is additional syntax available. problem and resolve the ambiguity there is additional syntax available.
Values prefixed with a dot are always treated as a protocol name. The Values prefixed with a dot are always treated as a protocol name. The
dot stands for the root of the protocol namespace and is optional). Values dot stands for the root of the protocol namespace and is optional). Values
prefixed with a colon are always interpreted as a byte array. prefixed with a colon are always interpreted as a byte array.
---- ----
frame[10:] contains .fc or frame[10] == :fc frame[10:] contains .fc or frame[10] == :fc
---- ----