Wireshark · Wireshark-users: Re: [Wireshark-users] are there any ways to filter specific DNS queries

[Tony Trinh <tony19@xxxxxxxxx>]

On Wed, Jun 20, 2012 at 2:07 PM, nangergong <nangergong@xxxxxxxxx> wrote:

thanks, is it possible to specify part of the name?
for example, ntp1-mifd.com
                   ntp2-mifd.com ......

is is possible to specify these group of names with something like wildcard
*-mifd.com

The <contains> operator should suffice for that pattern:

    dns.qry.name contains "-mifd.com"

...but you can also use the <matches> operator for regular-_expression_ matching, as in one of the following examples:

    dns.qry.name matches ".*-mifd.com$"

    dns.qry.name matches "ntp[12]-mifd.com"

See the wiki for more on display-filter syntax: http://wiki.wireshark.org/DisplayFilters