osmith
/
wireshark
forked from osmocom/wireshark
1
0
Fork 0
Code Pull Requests Releases Wiki Activity

docs: Update documentation to use ',' as set separator

This commit is contained in:
João Valverde 2021-10-29 18:37:05 +01:00
parent f78ebe1564
commit 6ae0044ebe
2 changed files with 9 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
dfilters
View File

@ -13,4 +13,4 @@
"TCP or UDP port is 80 (HTTP)" tcp.port == 80 || udp.port == 80
"HTTP" http
"No ARP and no DNS" not arp and !(udp.port == 53)
"Non-HTTP and non-SMTP to/from 192.0.2.1" ip.addr == 192.0.2.1 and not tcp.port in {80 25}
"Non-HTTP and non-SMTP to/from 192.0.2.1" ip.addr == 192.0.2.1 and tcp.port not in {80, 25}

15
docbook/wsug_src/WSUG_chapter_work.adoc
View File

@ -681,7 +681,7 @@ You can combine filter expressions in Wireshark using the logical operators show
|xor |^^ | Logical XOR | `tr.dst[0:3] == 0.6.29 xor tr.src[0:3] == 0.6.29`
|not |! | Logical NOT | `not llc`
|[...] | | Subsequence | See “Slice Operator” below.
|in | | Set Membership| http.request.method in {"HEAD" "GET"}. See “Membership Operator” below.
|in | | Set Membership| http.request.method in {"HEAD", "GET"}. See “Membership Operator” below.
|===
==== Slice Operator
@ -724,14 +724,15 @@ to form compound ranges as shown above.
Wireshark allows you to test a field for membership in a set of values or
fields. After the field name, use the `in` operator followed by the set items
surrounded by braces {}. For example, to display packets with a TCP source or
destination port of 80, 443, or 8080, you can use `tcp.port in {80 443 8080}`.
The set of values can also contain ranges: `tcp.port in {443 4430..4434}`.
destination port of 80, 443, or 8080, you can use `tcp.port in {80, 443, 8080}`.
Set elements must be separated by commas.
The set of values can also contain ranges: `tcp.port in {443,4430..4434}`.
[NOTE]
====
The display filter
----
tcp.port in {80 443 8080}
tcp.port in {80, 443, 8080}
----
is equivalent to
----
@ -739,7 +740,7 @@ tcp.port == 80 || tcp.port == 443 || tcp.port == 8080
----
However, the display filter
----
tcp.port in {443 4430..4434}
tcp.port in {443, 4430..4434}
----
is not equivalent to
----
@ -756,8 +757,8 @@ membership operator tests a single field against the range condition.
Sets are not just limited to numbers, other types can be used as well:
----
http.request.method in {"HEAD" "GET"}
ip.addr in {10.0.0.5 .. 10.0.0.9 192.168.1.1..192.168.1.9}
http.request.method in {"HEAD", "GET"}
ip.addr in {10.0.0.5 .. 10.0.0.9, 192.168.1.1..192.168.1.9}
frame.time_delta in {10 .. 10.5}
----