3 ms·
It's a bit more complicated than that. Wireshark allows two different filtering languages in two different places, used at different times. Your first example
by matthiasl 11y ago
It's a bit more complicated than that.
Wireshark allows two different filtering languages in two different places, used at different times.
Your first example ("ip.addr=127.0.0.1") is a display filter. You enter those in the text field at the top of the GUI.
Your third example, 'host 127.0.0.1' is a 'capture filter'. You can enter capture filters in Capture/options.
- est 11y agoI can understand that, but why do we invent these two different DSLs? I suppose they have a very large portion of overlap!
- matthiasl 11y agoThere are different trade-offs for the capture filter language and the display filter language. The capture filter language considers short and bounded runtime (no loops) to be paramount. Roughly, when you're capturing, it's important that your filters eat a limited amount of resources. Juha talks about this in the article. The display filter language abandons the careful runtime limits in favour of being more powerful. You can go higher up in the stack, you can use regexes, etc. That's acceptable because you're usually doing it offline. The conclusion of Juha's article is, roughly, "the libpcap DSL is sometimes frustrating, but I'm not aware of a clearly better alternative". I agree. I'd love it if someone invented something prettier but still solid.
- deleted 11y ago[deleted]