Description
TCP Viewer has a visual filter builder, but many people already know Wireshark display filters and use them every day.
Add a Wireshark mode to the packet filter panel. A user should be able to type or paste a Wireshark display filter and apply it without exporting the capture or opening another app.
The filter should use TCP Viewer's embedded Wireshark engine. This keeps the syntax and packet results close to Wireshark. The app should check the expression before applying it. If it is invalid, show a useful message, highlight the part that needs fixing, and keep the last working result on screen.
The current Builder mode should stay available for people who prefer the visual controls.
What the filter works with
- Protocol names such as
tcp, udp, dns, http, tls, icmp, arp, and ipv6.
- Protocol fields such as
tcp.port == 443, ip.addr == 192.168.1.10, and http.request.method == "GET".
- TLS fields, including server names such as
tls.handshake.extensions_server_name.
- Logic with
and, or, not, and parentheses.
- Text and payload checks with
contains and matches.
- Sets, ranges, field slices, and common Wireshark helper functions supported by the embedded Wireshark version.
- Wireshark columns such as
_ws.col.protocol and _ws.col.info.
- Imported
.pcap and .pcapng files.
- Running and stopped live captures.
- Existing quick filters and source-list selections.
- Saved custom filters and TCP Viewer session files, so the expression can be reused later.
Example
tcp.port == 443 and tls.handshake.extensions_server_name contains "example.com"
This should show HTTPS packets whose TLS server name contains example.com.
Related implementation: #95
Description
TCP Viewer has a visual filter builder, but many people already know Wireshark display filters and use them every day.
Add a Wireshark mode to the packet filter panel. A user should be able to type or paste a Wireshark display filter and apply it without exporting the capture or opening another app.
The filter should use TCP Viewer's embedded Wireshark engine. This keeps the syntax and packet results close to Wireshark. The app should check the expression before applying it. If it is invalid, show a useful message, highlight the part that needs fixing, and keep the last working result on screen.
The current Builder mode should stay available for people who prefer the visual controls.
What the filter works with
tcp,udp,dns,http,tls,icmp,arp, andipv6.tcp.port == 443,ip.addr == 192.168.1.10, andhttp.request.method == "GET".tls.handshake.extensions_server_name.and,or,not, and parentheses.containsandmatches._ws.col.protocoland_ws.col.info..pcapand.pcapngfiles.Example
This should show HTTPS packets whose TLS server name contains
example.com.Related implementation: #95