osmith
/
wireshark
forked from osmocom/wireshark
1
0
Fork 0
Code Pull Requests Releases Wiki Activity

docs: wireshark-filter - update man page

pespin/rlcmac
Chuck Craft 2021-06-25 14:37:57 -05:00 committed by Wireshark GitLab Utility
parent 4124986a9c
commit 820faa1777
1 changed files with 15 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
doc/wireshark-filter.pod
View File

@ -11,10 +11,10 @@ wireshark-filter - Wireshark display filter syntax and reference
=head1 SYNOPSIS
B<wireshark> [other options]
S<[ B<-Y> "display filter expression" | b<--display-filter> "display filter expression" ]>
S<[ B<-Y> "display filter expression" | B<--display-filter> "display filter expression" ]>
B<tshark> [other options]
S<[ B<-Y> "display filter expression" ]>
S<[ B<-Y> "display filter expression" | B<--display-filter> "display filter expression" ]>
=head1 DESCRIPTION
@ -81,14 +81,14 @@ implemented for protocols and for protocol fields with a text string
representation. Matches are case-insensitive by default. For example,
to search for a given WAP WSP User-Agent, you can write:
wsp.user_agent matches "cldc"
wsp.header.user_agent matches "cldc"
This would match "cldc", "CLDC", "cLdC" or any other combination of upper
and lower case letters.
You can force case sensitivity using
wsp.user_agent matches "(?-i)cldc"
wsp.header.user_agent matches "(?-i)cldc"
This is an example of PCRE's B<(?>optionB<)> construct. B<(?-i)> performs a
case-sensitive pattern match but other options can be specified as well. More
@ -150,12 +150,12 @@ An integer may be expressed in decimal, octal, or hexadecimal notation,
or as a C-style character constant. The following six display filters
are equivalent:
frame.pkt_len > 10
frame.pkt_len > 012
frame.pkt_len > 0xa
frame.pkt_len > '\n'
frame.pkt_len > '\xa'
frame.pkt_len > '\012'
frame.len > 10
frame.len > 012
frame.len > 0xa
frame.len > '\n'
frame.len > '\x0a'
frame.len > '\012'
Boolean values are either true or false. In a display filter expression
testing the value of a Boolean field, "true" is expressed as 1 or any
@ -180,8 +180,8 @@ digits. The hex digits may be separated by colons, periods, or hyphens:
IPv4 addresses can be represented in either dotted decimal notation or
by using the hostname:
ip.dst eq www.mit.edu
ip.src == 192.168.1.1
ip.dst eq www.mit.edu
IPv4 addresses can be compared with the same logical relations as numbers:
eq, ne, gt, ge, lt, and le. The IPv4 address is stored in host order,
@ -197,7 +197,7 @@ will find all packets in the 129.111 Class-B network:
Remember, the number after the slash represents the number of bits used
to represent the network. CIDR notation can also be used with
hostnames, as in this example of finding IP addresses on the same Class C
network as 'sneezy':
network as 'sneezy' (requires that 'sneezy' resolve to an IP address for filter to be valid):
ip.addr eq sneezy/24
@ -284,7 +284,7 @@ or
A slice is always compared against either a string or a byte sequence.
As a special case, when the slice is only 1 byte wide, you can compare
it against a hex integer that 0xff or less (which means it fits inside
it against a hex integer that is 0xff or less (which means it fits inside
one byte). This is not allowed for byte sequences greater than one byte,
because then one would need to specify the endianness of the multi-byte
integer. Also, this is not allowed for decimal numbers, since they
@ -450,7 +450,7 @@ The online Display Filter Reference: L<https://www.wireshark.org/docs/dfref/>
=item *
I<Help:Supported Protocols> in Wireshark
I<View:Internals:Supported Protocols> in Wireshark
=item *
@ -464,7 +464,7 @@ The Wireshark wiki: L<https://gitlab.com/wireshark/wireshark/-/wikis/DisplayFilt
=head1 NOTES
The B<wireshark-filters> manpage is part of the B<Wireshark> distribution.
The B<wireshark-filter(4)> manpage is part of the B<Wireshark> distribution.
The latest version of B<Wireshark> can be found at
L<https://www.wireshark.org>.