User Guide

9.8. Display Filter Macros
Display Filter Macros are a mechanism to create shortcuts for complex filters. For example defining
a display filter macro named tcp_conv whose text is ( (ip.src == $1 and ip.dst == $2 and
tcp.srcport == $3 and tcp.dstport == $4) or (ip.src == $2 and ip.dst == $1 and tcp.srcport ==
$4 and tcp.dstport == $3) ) would allow to use a display filter like
${tcp_conv:10.1.1.2;10.1.1.3;1200;1400} instead of typing the whole filter.
Display Filter Macros can be managed with a Section 9.7, “User Table” by selecting the Display
Filter Macros menu item from the View Menu. The User Table has the following fields
name The name of the macro.
text The replacement text for the macro it uses $1, $2, $3, ... as the input arguments.
Customizing Wireshark
184