Does a Wireshark Display Filter Macro[1] work for you?
Analyze -> Display Filter Macros -> [+]
Name: wlan_beacon
Text: wlan.fc.type_subtype == 0x19
[OK]
To use it:
${wlan_beacon}
- Chris
[1]:
https://www.wireshark.org/docs/wsug_html_chunked/ChDisplayFilterMacrosSection.html
> -----Original Message-----
> From: Wireshark-dev [mailto:[email protected]] On
> Behalf Of Richard Sharpe
> Sent: Wednesday, November 8, 2017 4:17 PM
> To: Developer support list for Wireshark <[email protected]>
> Subject: Re: [Wireshark-dev] Filter expression aliases and parameterization
> ...
>
> On Wed, Nov 8, 2017 at 1:04 PM, Simon Barber via Wireshark-dev <wireshark-
> [email protected]> wrote:
> > I'd love to be able to add these, for example instead of writing
> >
> > wlan.fc.type_subtype == 0x19
> >
> > write
> >
> > wlan.beacon
>
> OK, I'll mark you down as someone who is interested in aliasing of filter
> expressions. I will create a bug in bugzilla and then I can think about it,
> but only
> after I create a dissector table for the WPS stuff and fix a CISCO-related
> Wi-Fi
> issue someone asked me about.
>
> It will require some thought because we should probably indicate the alias
> when someone types in the other form. Ie, if they enter wlan.beacon it should
> list in brackets (wlan.fc.type_subtype == 0x19) and vice versa.
>
> --
> Regards,
> Richard Sharpe
> (何以解憂？唯有杜康。--曹操)
CONFIDENTIALITY NOTICE: This message is the property of International Game
Technology PLC and/or its subsidiaries and may contain proprietary,
confidential or trade secret information. This message is intended solely for
the use of the addressee. If you are not the intended recipient and have
received this message in error, please delete this message from your system.
Any unauthorized reading, distribution, copying, or other use of this message
or its attachments is strictly prohibited.
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <[email protected]>
Archives: https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
mailto:[email protected]?subject=unsubscribe
