10.8. Display Filter Macros
Prev | Chapter 10. Customizing Wireshark | Next

## 10.8. Display Filter Macros

Display Filter Macros are a mechanism to create shortcuts for complex filters. For example defining a display filter macro named tcp_conv whose text is ( (ip.src == $1 and ip.dst == $2 and tcp.srcport == $3 and tcp.dstport == $4) or (ip.src == $2 and ip.dst == $1 and tcp.srcport == $4 and tcp.dstport == $3) ) would allow to use a display filter like ${tcp_conv:10.1.1.2;10.1.1.3;1200;1400} instead of typing the whole filter.

Display Filter Macros can be managed with a Section 10.7, “User Table” by selecting Analyze → Display Filter Macros from the menu. The User Table has the following fields

Name

  The name of the macro.

Text

  The replacement text for the macro it uses $1, $2, $3, ... as the input arguments.

Prev | Up | Next
10.7. User Table | Home | 10.9. ESS Category Attributes