Wireshark - 1.0 Betriebsanweisung PDF herunterladen (Seite 133)

6.5. The "Filter Expression" dialog box

When you are accustomed to Wireshark's filtering system and know what labels you wish to use in

your filters it can be very quick to simply type a filter string. However if you are new to Wireshark

or are working with a slightly unfamiliar protocol it can be very confusing to try to figure out what

to type. The Filter Expression dialog box helps with this.

Tip!

The "Filter Expression" dialog box is an excellent way to learn how to write Wireshark

display filter strings.

Figure 6.6. The "Filter Expression" dialog box

When you first bring up the Filter Expression dialog box you are shown a tree list of field names,

organized by protocol, and a box for selecting a relation.

Field Name Select a protocol field from the protocol field tree. Every protocol with filterable

fields is listed at the top level. (You can search for a particular protocol entry by

entering the first few letters of the protocol name). By clicking on the "+" next to a

protocol name you can get a list of the field names available for filtering for that

protocol.

Relation Select a relation from the list of available relation. The is present is a unary rela-

tion which is true if the selected field is present in a packet. All other listed rela-

tions are binary relations which require additional data (e.g. a Value to match) to

complete.

When you select a field from the field name list and select a binary relation (such as the equality re-

lation ==) you will be given the opportunity to enter a value, and possibly some range information.

Working with captured packets

118

1 2 ... 128 129 130 131 132 133 134 135 136 137 138 ... 283 284

Keine Kommentare

Wireshark - 1.0 Betriebsanweisung Seite 133