@ -41,14 +41,22 @@ field. If you want to see all packets which contain the IP protocol, the
filter would be "ip" (without the quotation marks). To see all packets
that contain a Token-Ring RIF field, use "tr.rif".
Think of a protocol or field in a filter as implicitly having the "exists"
Whenever a protocol or field appears as the argument of a function in a filter,
an exists operator for that protocol or field implicitly appears.
=== Values and operators
Each field has a value, and that value can be used in operations with
comparable values (which may be literals, other fields, or function results).
The value of a field is not necessarily what appears in the *Wireshark*
display or *TShark* output. For example, a protocol is semantically
equivalent to the sequence of bytes that it spans, not its displayed text
in the protocol tree.
=== Comparison operators
Fields can also be compared against values. The comparison operators
can be expressed either through English-like abbreviations or through
The comparison operators can be expressed either through English-like
abbreviations or through C-like symbols:
eq, == Equal
ne, != Not Equal
@ -57,18 +65,27 @@ C-like symbols:
ge, >= Greater than or Equal to
le, <= Less than or Equal to
The ordering depends on the value type in the usual way (e.g., lexicographic
for strings and arithmetic for integers.) A field may appear more than once
in a given frame. In general, if any apperance of a field has a value that
satisfies its operator, then the expression evaluates to true. The one
exception is the "!=" operator, which asserts that _all_ appearances of a field
are not equal to a value, making it the logical negation of the "==" operator.footnote:[This differs from previous, deprecated behavior. To obtain the old behavior, which was true if any appearance was not equal, use the "any_ne", "~=" operator.]
=== Search and match operators
Additional operators exist expressed only in English, not C-like syntax:
contains Does the protocol, field or slice contain a value
matches, ~ Does the protocol or text string match the given