Wireshark Display Filters automatically populated from WebUI

[tiago-amado]

When we have a network setup and we want to show the capture in multiple nodes, we may need to open multiple Wireshark sessions and we need to manually insert the display filter in all of them ("macsec or icmp or mpls").

The EdgeShark WebUI could have an optional setting that, if enable, provides a “Wireshark Display Filter” textbox to allow the user to insert the filter, and then, this is automatically populated in every Wireshark session.

The textbox will not perform syntax check (when the user opens the first session the wireshark will complain and the user could fix it).
Ideally the textbox could have history to display previous used strings (when the user hover the mouse over the textbox).

[thediveo]

Do you regularly use the same display filter for all your wireshark sessions?

[tiago-amado]

it depends on the setup, but yes. E.g. for troubleshoot I may need to display only "arp or icmp" and then open sessions for multiple nodes with same filter. For demos this is very useful since when we open the Wireshark it will display immediately the packets we want to show and we don't need to insert the filter.