Wireshark-dev: Re: [Wireshark-dev] Filter expression aliases and parameterization ...
Does a Wireshark Display Filter Macro[1] work for you?
Analyze -> Display Filter Macros -> [+]
Name: wlan_beacon
Text: wlan.fc.type_subtype == 0x19
[OK]
To use it:
${wlan_beacon}
- Chris
[1]: https://www.wireshark.org/docs/wsug_html_chunked/ChDisplayFilterMacrosSection.html
> -----Original Message-----
> From: Wireshark-dev [mailto:wireshark-dev-bounces@xxxxxxxxxxxxx] On
> Behalf Of Richard Sharpe
> Sent: Wednesday, November 8, 2017 4:17 PM
> To: Developer support list for Wireshark <wireshark-dev@xxxxxxxxxxxxx>
> Subject: Re: [Wireshark-dev] Filter expression aliases and parameterization ...
>
> On Wed, Nov 8, 2017 at 1:04 PM, Simon Barber via Wireshark-dev <wireshark-
> dev@xxxxxxxxxxxxx> wrote:
> > I'd love to be able to add these, for example instead of writing
> >
> > wlan.fc.type_subtype == 0x19
> >
> > write
> >
> > wlan.beacon
>
> OK, I'll mark you down as someone who is interested in aliasing of filter
> expressions. I will create a bug in bugzilla and then I can think about it, but only
> after I create a dissector table for the WPS stuff and fix a CISCO-related Wi-Fi
> issue someone asked me about.
>
> It will require some thought because we should probably indicate the alias
> when someone types in the other form. Ie, if they enter wlan.beacon it should
> list in brackets (wlan.fc.type_subtype == 0x19) and vice versa.
>
> --
> Regards,
> Richard Sharpe
> (何以解憂？唯有杜康。--曹操)
CONFIDENTIALITY NOTICE: This message is the property of International Game Technology PLC and/or its subsidiaries and may contain proprietary, confidential or trade secret information. This message is intended solely for the use of the addressee. If you are not the intended recipient and have received this message in error, please delete this message from your system. Any unauthorized reading, distribution, copying, or other use of this message or its attachments is strictly prohibited.
