Wireshark-dev: Re: [Wireshark-dev] Display filter using wildcards
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Fri, 07 Sep 2012 08:53:46 +0200
Hi,
Have a look in epan/dfilter/. There's the grammar.lemon and scanner.l(ex) that do the work. 

Thanks,
Jaap

On 09/07/2012 04:55 AM, Ken Sarmago wrote:

Hi all,

I'm new to this list. First of all, kudos to all wireshark developers for a
great tool.

I've been trying to create a Display filter for address fields using wildcards '*'.
e.g.
of.match_dl_dst == 10:00:12:34:56:*
of.match_dl_dst == 10:00:12:34:*:*
of.match_dl_dst == 10:00:12:*:*:*
of.match_dl_dst == 10:00:*:*:*:*
of.match_dl_dst == 10:00:*:*:56:78

Has anyone done this before?

I know there are other filter expressions that can serve the same purpose, but
what if I really want to use wildcards '*'.

If I were to modify wireshark filter function, were will I start?

Thanks a lot in advance,
Ken