Wireshark · Ethereal-dev: Re: [Ethereal-dev] Match selected from packet list & Prepare line

[Guy Harris <gharris@xxxxxxxxx>]

On Fri, Jan 04, 2002 at 09:43:19AM +0100, Jirka Novak wrote:
> > 4) Insert the filter at the current cursor position in the filter field
> > at the bottom of the screen but *don't* apply the filter immediately.
> 
>                                ^^^^^^^^^^^^^^^^^ it is not possible if 
> you use 'Match Selected'

So don't use "Match selected", use something else!

For example, if you want a filter that selects all packets that match
field X of frame N and field Y of frame M, you:

	clear the filter field at the bottom of the screen (just clear
	the text field, e.g.  by typing control-U, don't apply the new
	empty flter)

	select frame N

	select field X of frame N

	select "Insert in filter" (or whatever it'd be called) from the
	right-button menu (this is a new right-button menu item that'd
	be added)

	add the word "and" after the filter in the filter field (this
	puts the cursor after the word "and")

	select frame M

	select field Y of frame M

	select "Insert in filter" from the right-button menu

You now have the expression you want in the filter field at the bottom
of the window.  Now click on that field and type the <Enter> key, and
that filter will be applied.