Wireshark-style Display Filters

[matkinson847]

Is there an existing issue for this?

• I have searched the existing issues.

Describe the solution you'd like

I’m using BPF capture filters with Sniffnet successfully — it works just right. Display filters would allow faster and more flexible filtering, on the fly, and I would use it far more than capture filters. Would love this as a future feature.

Is your feature request related to a problem?

No response

[GyulyVGC]

Thanks for the feature request @matkinson847

By default Sniffnet doesn't collect the full packets payloads so some of the filters Wireshark is providing may not be applicable here.

Could you kindly make some examples about the filtering capabilities you're interested in that are not already covered by the existing filters in Inspect page?

[matkinson847]

The existing filter system allows me to include or exclude any one item of the same type (for example, in Protocol, "TCP" and "!TCP" work as expected), but it does not appear that I can include or exclude multiple items of the same type "!(tcp or udp)". Also, filtering on packet size is not currently supported.

This is a minor use case for me, and I can work around it with Sniffnet as it is. But the capability would speed up my workflow for troubleshooting.

I envision this proposed feature as a configurable option. If turned on, as changes are made to the display filter bar they're reflected in the existing filter configuration, and vice versa. This would allow those who are well versed in that style of display filter the option to use it, while retaining the current ease of use.

Alternatively, adding logic operators and adding a filter option for Bytes would solve my use case, and I imagine it would be easier for you to implement.

Thanks again for Sniffnet (it's fantastic!) and for considering this request!