Wireshark frame.marked == 1
https://www.wireshark.org/lists/wireshark-users/201004/msg00032.html
Tim Black wrote:
> I would love to be able to customize the display of packets in an absolute
> fashion, e.g. "Ignore this one" or "show only this one and this one". To me
> this means there would be a Display Filter field for packet number. Is there
> support for this hiding from me somewhere, or if not, is there at least a
> plan to support this? To be clear, I am talking about Display Filtering by
> the leftmost column entitled "No.". I hope this is not also the answer to my
> question. ;-)
How about Ctrl-M to mark either the packets you want to display, or the
packets you want to ignore. Then:
"frame.marked == 1" to display only the marked packets, or
"frame.marked == 0" to ignore the marked packets and display only the
unmarked packets.
Ulasan