diff options
Diffstat (limited to 'doc/wireshark-filter.pod')
| -rw-r--r-- | doc/wireshark-filter.pod | 24 |
1 files changed, 15 insertions, 9 deletions
diff --git a/doc/wireshark-filter.pod b/doc/wireshark-filter.pod index 0b8613de4c..a6ef64f58a 100644 --- a/doc/wireshark-filter.pod +++ b/doc/wireshark-filter.pod @@ -56,8 +56,8 @@ C-like symbols: Additional operators exist expressed only in English, not C-like syntax: contains Does the protocol, field or slice contain a value - matches, ~ Does the protocol or text string match the given Perl - regular expression + matches, ~ Does the protocol or text string match the given + case-insensitive Perl-compatible regular expression The "contains" operator allows a filter to search for a sequence of characters, expressed as a string (quoted or unquoted), or bytes, @@ -73,15 +73,21 @@ such as numbers or IP addresses. The "matches" or "~" operator allows a filter to apply to a specified Perl-compatible regular expression (PCRE). The "matches" operator is only implemented for protocols and for protocol fields with a text string -representation. For example, to search for a given WAP WSP User-Agent, -you can write: +representation. Matches are case-insensitive by default. For example, +to search for a given WAP WSP User-Agent, you can write: - wsp.user_agent matches "(?i)cldc" + wsp.user_agent matches "cldc" -This example shows an interesting PCRE feature: pattern match options have to -be specified with the B<(?>optionB<)> construct. For instance, B<(?i)> performs -a case-insensitive pattern match. More information on PCRE can be found in the -pcrepattern(3) man page (Perl Regular Expressions are explained in +This would match "cldc", "CLDC", "cLdC" or any other combination of upper +and lower case letters. + +You can force case sensitivity using + + wsp.user_agent matches "(?-i)cldc" + +This is an example of PCRE's B<(?>optionB<)> construct. B<(?-i)> performs a +case-sensitive pattern match but other options can be specified as well. More +information can be found in the pcrepattern(3) man page at L<http://perldoc.perl.org/perlre.html>). =head2 Functions |