Configuring macros

Display filter macros are used to create shortcuts for complex display filters, which you can configure once and use later.

Getting ready

To configure display filter macros, navigate to Analyze | Display Filter Macros | New.

You will get the following window:

Getting ready

How to do it...

  1. In order to configure a macro, you give it a name and fill the textbox with the filter string.
  2. In order to activate the macro, you simply write $(macro_name:parameter1;paramater2;parameter3 …).
  3. Let's configure a simple filter name, test01, which takes the following parameters as values:
    • ip.src == <value>
    • tcp.dstport == <value>

    This will be a filter that looks for packets from a specific source network that go out to the HTTP port.

    A macro that takes these two parameters will be: ip.src==$1 && tcp.dstport==$2.

  4. Now, in order to get the filter results for the parameters ip.src == 10.0.0.4 and tcp.dstport == 80, we should write the string ${test01:10.0.0.4;80} in the display window bar.

How it works...

Macros work in a simple way; you write a filter string with the sign $ ahead of every positional parameter. While running the macros, it will accept the parameters in order.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.135.212.238