Wireshark-users: Re: [Wireshark-users] Names in display filter ip address specs
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Fri, 26 Feb 2010 23:37:46 +0100
Hallo,
Well, I just followed the reasoning of Chuck. I didn't dive into the actual workings of this feature. So, YMMV. 

Thanks,
Jaap

j.snelders wrote:

Hoi Jaap,

I created a hosts file:
192.168.1.1 comp1
192.168.1.4 comp4

I can use filters like:
eth.addr eq comp4
eth.src == comp4

But what is wrong about these filters; they are invalid:
ip.addr eq comp4
ip.src == comp4

Version 1.3.3-SVN-31356 (SVN Rev 31356 from /trunk)

Bedankt
Joke

http://wiki.wireshark.org/Preferences/NameResolution
http://www.wireshark.org/docs/wsug_html_chunked/ChAppFilesConfigurationSection.html


On Fri, 26 Feb 2010 19:26:24 +0100 Jaap Keuter wrote:
Hi,

Well, that's not the development version, so it won't work.

Thanks,
Jaap

Bland Chuck-CNGR85 wrote:

    Folks,

    If I have my answer I don't know that I do.

    Can I use names for IP addresses in Display Filters using version 1.2.6?
    It does not seem so to me.

    Chuck Bland

    -----Original Message-----

    From: Bland Chuck-CNGR85 Sent: Monday, February 22, 2010 16:31 PM

    To: 'Community support list for Wireshark'
    Subject: RE: [Wireshark-users] Names in display filter ip address specs


    1.2.6

    -----Original Message-----
    From: wireshark-users-bounces@xxxxxxxxxxxxx
    [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Jaap Keuter
    Sent: Monday, February 22, 2010 16:28 PM
    To: Community support list for Wireshark
    Subject: Re: [Wireshark-users] Names in display filter ip address specs

    Hi,

    That would probably be with the new development version then.
    What are you using?

    Thanks,
    Jaap

    Bland Chuck-CNGR85 wrote:

        Folks,

        Please straighten me out on this.

        I have found Display Filter info that tells me stuff like this works:

        Ip.addr == sneezy/24

        I haven't been able to make that work.

        Bottom line, can I use names in IP address specs in display filters
or

        can it only be numbers?

        Chuck