Wireshark · Wireshark-users: Re: [Wireshark-users] display filter on packet number

[Tim Black <timblaktu@xxxxxxxxx>]

Thanks Bill and Jim. I couldnt' find this was because I searched http://www.wireshark.org/docs/dfref/ for "number" and "No." and didn't find anything pertinent. Now that I know it's called Frame, I see all the goodies I was looking for and they work like a charm!

On Mon, Apr 5, 2010 at 11:45 AM, Jim Aragon <Jim@xxxxxxxxxxxxxxx> wrote:

Tim Black wrote:

> I would love to be able to customize the display of packets in an absolute
> fashion, e.g. "Ignore this one" or "show only this one and this one". To me
> this means there would be a Display Filter field for packet number. Is there
> support for this hiding from me somewhere, or if not, is there at least a
> plan to support this? To be clear, I am talking about Display Filtering by
> the leftmost column entitled "No.". I hope this is not also the answer to my
> question. ;-)

How about Ctrl-M to mark either the packets you want to display, or the
packets you want to ignore. Then:

"frame.marked == 1" to display only the marked packets, or

"frame.marked == 0" to ignore the marked packets and display only the
unmarked packets.

Jim Aragon

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe