osmocom
/
wireshark
14
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

WSUG: Update Display Filter Macro documentation

This commit is contained in:
João Valverde 2023-11-12 07:09:03 +00:00
parent b0ae205c51
commit b553202875
4 changed files with 13 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
docbook/wsug_src/images/ws-filter-macros.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 52 KiB

After

Width:  |  Height:  |  Size: 30 KiB

17
docbook/wsug_src/wsug_customize.adoc
View File

@ -1095,24 +1095,29 @@ or (ip.src == $2 and ip.dst == $1 and tcp.srcport == $4 and tcp.dstport == $3)
would allow to use a display filter like
----
$tcp_conv(10.1.1.2, 10.1.1.3, 1200, 1400)
----
or alternatively
----
${tcp_conv:10.1.1.2;10.1.1.3;1200;1400}
----
instead of typing the whole filter. Once defined, a macro can
instead of typing the whole filter. Both notations are equivalent. Once defined, a macro can
be used in <<ChWorkDefineFilterSection,saved display (but not
capture) filters>> and <<ChCustFilterButtons,filter buttons>>.
Display Filter Macros can be managed with a user table, as described in
<<ChUserTable>>, by selecting menu:Analyze[Display Filter Macros] from
the menu. The User Table has the following fields:
Display Filter Macros can be managed by selecting menu:Analyze[Display Filter Macros] from
the menu. The table has the following fields:
Name::
Macro Name::
The name of the macro. The name must consist of ASCII alphanumerics or
the '_' character. (Note that the presence of a '.' character would
indicate a <<_field_references,field reference>>.)
Text::
Macro Expression::
The replacement text for the macro it uses $1, $2, $3, ... as the input arguments.
[#ChEssCategoryAttributes]

2
docbook/wsug_src/wsug_work.adoc
View File

@ -1198,7 +1198,7 @@ image::images/ws-filter-macros.png[{screenshot-attrs}]
. To add a new filter macro, click the btn:[{plus}] button in the bottom-left corner. A new row will appear in the Display Filter Macros table above.
. Enter the name of your macro in the `Name` column. Enter your filter macro in the `Text` column.
. Enter the name of your macro in the `Macro Name` column. Enter your filter macro in the `Macro Expression` column.
. To save your modifications, click the btn:[OK] button in the bottom-right corner of the <<FilterMacrosDialog>>.

2
resources/share/wireshark/dmacros
View File

@ -2,4 +2,4 @@
# For your personal macros you can use the same file in your profile dir.
"private_ipv4" $1 == 192.168.0.0/16 or $1 == 172.16.0.0/12 or $1 == 10.0.0.0/8
"private_ethernet" $1[0] & 0x0F == 2
"private_ipv6" ipv6 && $1 == fc00::/7
"private_ipv6" ipv6 and $1 == fc00::/7