I have a Wireshark capture and I'm trying to create a display filter [Wireshark documentation] that finds XML documents which contain the term @@ V? (at-at-space-V-questionmark). The documentation says Perl Regex are used:

The matches operator makes it possible to search for text in string fields and byte sequences using a regular expression, using Perl regular expression syntax.


Note: Wireshark needs to be built with libpcre in order to be able to use the matches operator.

I can't find out whether this condition applies, but in general I can use the matches operator, so I'd assume that part is fulfilled.

IMHO the filter xml matches "@@ V\?" should work, but it finds XML that does not fit the criterion, e.g. an XML like

<?xml version="1.0"?>
<dialog><sysdef name="TERMREC" value="@@ U1160613113912"/></dialog>

What's wrong with my filter or with Wireshark?

Using a filter without special characters (e.g. xml matches "@@ V0") works as expected. Other filters with special characters (e.g. xml matches "@@ V1\*") do not work as well.

  • your question isn't really clear, so do you have a regex pattern @@ V\? and it matches @@ U1160613113912? – Máté Juhász Jun 14 '16 at 7:42
  • @MátéJuhász: Unfortunately, Wireshark does not display which part of the XML actually matches. A filter xml matches "@@ V0" for example works as expected, so I guess it has to do with the ? which I escaped as \?. – Thomas Weller Jun 14 '16 at 7:45

It turns out that I have to use a double backslash, e.g. xml matches "@@ V\\?" and xml matches "@@ V1\\*".

I knew this has to be done in code like C++ or C#, but didn't expect this in a user input field. Especially, I wonder why an invalid expression with a single backslash does not result in an error but provides false results instead.

I have opened Wireshark Bug 12522.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.