Wireshark · Wireshark-dev: Re: [Wireshark-dev] Seaching in the data pane would be useful ...

[Christopher Maynard <Christopher.Maynard@xxxxxxxxx>]

Richard Sharpe <realrichardsharpe@...> writes:

> Sure, I can do the search, and I did, but the actual info I am
> interested in, like the priority, etc, is buried among 230 entries and
> I have to patiently scroll until I find it.
> 
> That is hard to do.

I see your point.  My attempt using tshark didn't produce very good results
either.

tshark -r kdcqueries.pcap -Y dns.resp.addr -T fields -e frame.number -e
dns.resp.name -e dns.resp.addr

There does seem to be a limitation in the search feature where it only finds
a packet containing a match, but not each highlighted matching instance of
the search criteria within a packet when you "search next/previous".