diff options
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/README.dissector | 22 | ||||
| -rw-r--r-- | doc/wireshark-filter.pod | 12 |
2 files changed, 26 insertions, 8 deletions
diff --git a/doc/README.dissector b/doc/README.dissector index bd34d416fb..e15ca6e26c 100644 --- a/doc/README.dissector +++ b/doc/README.dissector @@ -103,7 +103,7 @@ PROTOABBREV A name for the protocol for use in filter expressions; FIELDNAME The displayed name for the header field. FIELDABBREV The abbreviated name for the header field; it may contain only letters, digits, hyphens, underscores, and periods. -FIELDTYPE FT_NONE, FT_BOOLEAN, FT_UINT8, FT_UINT16, FT_UINT24, +FIELDTYPE FT_NONE, FT_BOOLEAN, FT_CHAR, FT_UINT8, FT_UINT16, FT_UINT24, FT_UINT32, FT_UINT40, FT_UINT48, FT_UINT56, FT_UINT64, FT_INT8, FT_INT16, FT_INT24, FT_INT32, FT_INT40, FT_INT48, FT_INT56, FT_INT64, FT_FLOAT, FT_DOUBLE, FT_ABSOLUTE_TIME, @@ -129,6 +129,13 @@ FIELDDISPLAY --For FT_UINT{8,16,24,32,40,48,56,64} and BASE_PT_UDP, BASE_PT_TCP, BASE_PT_DCCP or BASE_PT_SCTP + --For FT_CHAR: + BASE_HEX, BASE_OCT, BASE_CUSTOM, or BASE_NONE, possibly + ORed with BASE_RANGE_STRING, BASE_EXT_STRING or + BASE_VAL64_STRING. + + BASE_NONE can be used in the same way as with FT_UINT8. + --For FT_ABSOLUTE_TIME: ABSOLUTE_TIME_LOCAL, ABSOLUTE_TIME_UTC, or @@ -747,6 +754,9 @@ The type of value this field holds. The current field types are: FT_FRAMENUM A frame number; if this is used, the "Go To Corresponding Frame" menu item can work on that field. + FT_CHAR An 8-bit ASCII character. It's treated similarly to an + FT_UINT8, but is displayed as a C-style character + constant. FT_UINT8 An 8-bit unsigned integer. FT_UINT16 A 16-bit unsigned integer. FT_UINT24 A 24-bit unsigned integer. @@ -880,9 +890,11 @@ For FT_BOOLEAN fields that are also bitfields (i.e., 'bitmask' is non-zero), wide the parent bitfield is). (If the FT_BOOLEAN 'bitmask' is zero, then 'display' must be BASE_NONE). -For integer fields a "field-width" is not needed since the type of integer itself -(FT_UINT8, FT_UINT16, FT_UINT24, FT_UINT32, FT_UINT40, FT_UINT48, FT_UINT56, -FT_UINT64, etc) tells the proto_tree how wide the parent bitfield is. +For integer fields a "field-width" is not needed since the type of +integer itself (FT_UINT8, FT_UINT16, FT_UINT24, FT_UINT32, FT_UINT40, +FT_UINT48, FT_UINT56, FT_UINT64, etc) tells the proto_tree how wide the +parent bitfield is. The same is true of FT_CHAR, as it's an 8-bit +character. For FT_ABSOLUTE_TIME fields, 'display' is used to indicate whether the time is to be displayed as a time in the time zone for the machine on @@ -1125,7 +1137,7 @@ for protocols with variable-width header fields. Note that the formats used must all belong to the same group as defined below: - FT_INT8, FT_INT16, FT_INT24 and FT_INT32 -- FT_UINT8, FT_UINT16, FT_UINT24, FT_UINT32, FT_IPXNET and FT_FRAMENUM +- FT_CHAR, FT_UINT8, FT_UINT16, FT_UINT24, FT_UINT32, FT_IPXNET and FT_FRAMENUM - FT_INT40, FT_INT48, FT_INT56 and FT_INT64 - FT_UINT40, FT_UINT48, FT_UINT56, FT_UINT64 and FT_EUI64 - FT_ABSOLUTE_TIME and FT_RELATIVE_TIME diff --git a/doc/wireshark-filter.pod b/doc/wireshark-filter.pod index db7ba219ba..6ad3874c04 100644 --- a/doc/wireshark-filter.pod +++ b/doc/wireshark-filter.pod @@ -61,7 +61,8 @@ Additional operators exist expressed only in English, not C-like syntax: The "contains" operator allows a filter to search for a sequence of characters, expressed as a string (quoted or unquoted), or bytes, -expressed as a byte array. For example, to search for a given HTTP +expressed as a byte array, or for a single character, expressed as a +C-style character constant. For example, to search for a given HTTP URL in a capture, the following filter can be used: http contains "https://www.wireshark.org" @@ -120,13 +121,18 @@ Each protocol field is typed. The types are: Signed integer, 1, 2, 3, 4, or 8 bytes Time offset Unsigned integer, 1, 2, 3, 4, or 8 bytes + 1-byte ASCII character -An integer may be expressed in decimal, octal, or hexadecimal notation. -The following three display filters are equivalent: +An integer may be expressed in decimal, octal, or hexadecimal notation, +or as a C-style character constant. The following six display filters +are equivalent: frame.pkt_len > 10 frame.pkt_len > 012 frame.pkt_len > 0xa + frame.pkt_len > '\n' + frame.pkt_len > '\xa' + frame.pkt_len > '\012' Boolean values are either true or false. In a display filter expression testing the value of a Boolean field, "true" is expressed as 1 or any |