Display Filter Functions

Views: 551Most Wireshark users learn display filters by comparing a field to a value: ip.addr == 192.168.1.10 tcp.port == 443 dns.qry.name contains “example” But modern Wireshark display filters can do much more than simple comparisons. The filter language includes functions that can measure field lengths, count repeated fields, manipulate text, compare values, and even convert