Wireshark-users: [Wireshark-users] Launching a new window from Display filters
Date Prev · Date Next · Thread Prev · Thread Next
From: FS <bastiji@xxxxxxxxx>
Date: Tue, 2 Oct 2012 10:24:35 -0400
Folks - My sincere thanks for a wonderful product which has saved the day for me many times. There's one thing I haven't been able to do so far and I thought asking the knowledgeable folks here might be a good idea. I did try googling without any luck.

The workflow of using wireshark, for me at least, is to open a capture, focus in on a conversation and then try and use further filters to get the information I'm looking for. Is there a way to launch a separate Wireshark window instance with the results of the display filter, so within the new window I can use further display filters to get the data I want. Currently if the display filter doesn't show what I want, then I have to clear the filter completely and re-type (or paste depending on circumstance) the filters again and start afresh.

I know I can save the displayed packets as a separate capture, and then open it up, but hoping there is another better way to do it.

Any help appreciated!

Thanks,
Basti Ji