Wireshark-users: Re: [Wireshark-users] tcp.flags.psh as display filter?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Sake Blok <sake@xxxxxxxxxx>
Date: Fri, 11 Jan 2008 13:20:09 +0100
On Fri, Jan 11, 2008 at 12:28:17PM +0100, DW wrote:
> unfortunately tcp.flags.psh isn't available as Filter Expression.
> is there a way to add this filter expression manually?
> or is there another way to filter by this flag? regexp search in the Info Column?

I assume you want to filter on the TCP PUSH flag? If so, you can do this
by using:  tcp.flags.push == 1

If you use  tcp.flags.push  without testing it's value, it merely tests
whether there is a TCP PUSH flag, regardless of it being set. Effectively
this shows you all TCP packets, since every TCP packet has TCP flags in
it's header.

You can easily find out how to filter things by rightclicking in the 
packet-detail pane. Then choose apply as filter or prepare as filter.

Hope this helps,
Cheers,
    Sake