Wireshark · Ethereal-dev: Re: [Ethereal-dev] boolean operators in coloring rules

["Martin Regner" <martin.regner@xxxxxxxxx>]

J. Smith wrote
> I would like to create a coloring rule in ethereal that colors all packets 
> that have HTTP response codes that are greater than or equal to 200, and 
> less than 300. I tried to do this using the following coloring rule, but it 
> appears that this is not valid syntax. :
> 
> http.response.code >= 200 AND http.response.code < 300
> 
> So it looks like it is currently not possible to use boolean operators (like 
> 'OR', 'AND') in ethereal color filters - would it be possible to add support 
> for that in ethereal, or would that need a lot of effort ? Also, is there 
> anyone who knows if it is possible to create such coloring rules in ethereal 
> by other means ?


Use 'and' or '&&' instead of 'AND' respectivelly 'or' or '||' instead of 'OR'

http://www.ethereal.com/docs/user-guide/ChWorkBuildDisplayFilterSection.html

(http.response.code >= 200) and (http.response.code < 300)