Ethereal User's Guide: V1.1 for Ethereal 0.8.19 | ||
---|---|---|
<<< Previous | Using Ethereal | Next >>> |
When you are accustomed to Ethereal's filtering system and know what labels you wish to use in your filters it can be very quick to simply type a filter string. However if you are new to Ethereal or are working with a slightly unfamiliar protocol it can be very confusing to try to figure out what to type. The Add Expression dialog box helps with this.
When you first bring up the Add Expression dialog box you are shown a tree list of field names, organized by protocol, and a box for selecting a relation.
Select a protocols field from the protocol field tree. Every protocol with filterable fields is listed at the top level. By clicking on the "+" next to a protocol name you can get a list of the field names available for filtering for that protocol.
Select a relation from the list of available relation. The is present is a unary relation which is true if the selected field is present in a packet. All other listed relations are binary relations require additional data ( ie a Value to match ) to complete.
When you select a field from the field name list and select a binary relation ( like the equality relation == ) you will be given the opportunity to enter a value, and possible some range information.
You may enter an appropriate value in the Value text box. The Value will also indicate the type of value for the field name you have selected ( like character string ).
When you have built a satisfactory expression click Accept and a filter string will be built for you.
You can leave the Add Expression... dialog box without any effect by clicking the Close
The Add Expression dialog box is an excellent way to learn to write Ethereal display filter strings.
<<< Previous | Home | Next >>> |
Defining and saving filters | Up | Printing packets |