Lucent Technologies Ethereal - Manual (Page 123)

6.4. The "Filter Expression" dialog box
When you are accustomed to Ethereal's filtering system and know what labels you wish to use in
your filters it can be very quick to simply type a filter string. However if you are new to Ethereal or
are working with a slightly unfamiliar protocol it can be very confusing to try to figure out what to
type. The Filter Expression dialog box helps with this.
Tip!
The "Filter Expression" dialog box is an excellent way to learn how to write Ethereal
display filter strings.
Figure 6.7. The "Filter Expression" dialog box
When you first bring up the Filter Expression dialog box you are shown a tree list of field names,
organized by protocol, and a box for selecting a relation.
Field Name Select a protocol field from the protocol field tree. Every protocol with filterable
fields is listed at the top level. By clicking on the "+" next to a protocol name you
can get a list of the field names available for filtering for that protocol.
Relation Select a relation from the list of available relation. The is present is a unary rela-
tion which is true if the selected field is present in a packet. All other listed rela-
tions are binary relations which require additional data (e.g. a Value to match) to
complete.
When you select a field from the field name list and select a binary relation (such as the equality re-
lation ==) you will be given the opportunity to enter a value, and possibly some range information.
Working with captured packets
109