Chapter 3. Using Ethereal

Add Expression...

This button brings up the Add Expression dialog box which assists in building filter strings. You can find more information about the Add Expression dialog in the section called The Add Expression Dialog

The Add Expression Dialog

When you are accustomed to Ethereal’s filtering system and know what labels you wish to use in your filters it can be very quick to simply type a filter string. However if you are new to Ethereal or are working with a slightly unfamiliar protocol it can be very confusing to try to figure out what to type. The Add Expression dialog box helps with this.

Figure 3-25. The Ethereal Add Expression dialog box, view 1

When you first bring up the Add Expression dialog box you are shown a tree list of field names, organized by protocol, and a box for selecting a relation.

Field Name

Select a protocols field from the protocol field tree. Every protocol with filterable fields is listed at the top level. By clicking on the "+" next to a protocol name you can get a list of the field names available for filtering for that protocol.

82

Chapter 3. Using Ethereal

Relation

Select a relation from the list of available relation. The is present is a unary relation which is true if the selected field is present in a packet. All other listed relations are binary relations require additional data ( ie a Value to match ) to complete.

Figure 3-26. The Ethereal Add Expression dialog box, view 2

When you select a field from the field name list and select a binary relation ( like the equality relation == ) you will be given the opportunity to enter a value, and possible some range information.

Value

You may enter an appropriate value in the Value text box. The Value will also indicate the type of value for the field name you have selected ( like character string ).

Accept

When you have built a satisfactory expression click Accept and a filter string will be built for you.

Close

You can leave the Add Expression... dialog box without any effect by clicking the Close

83

Chapter 3. Using Ethereal

Figure 3-27. The result of building a filter string using the Add Expression dialog box.

The Add Expression dialog box is an excellent way to learn to write Ethereal display filter strings.

Printing packets

Ethereal provides two methods for printing packets:

1.Select the Print... menu item from the File menu. When you do this, Ethereal pops up the Print dialog box as shown in Figure 3-28.

2.Select the Print Packet menu item from the File menu (or type Ctrl-P) and Ethereal will print the currently selected packet.

We present more detail on the Print dialog box below.

84

Chapter 3. Using Ethereal

Figure 3-28. The Ethereal Print dialog box

Note: Currently, there is no simple way with the Print dialog box to print only a range of packets, or to print a single packet. To do this, first select a range of packets with a display filter, then select Print... from the File menu. You could even select a single packet with something like frame.number == 10 or a range by frame number with something like frame.number >= 10 && frame.number <= 20.

The following fields are available in the Print dialog box:

Format

This field contains a pair of mutually exclusive radio buttons:

•Plain Text, which specifies that the packet print should be in plain text.

•PostScipt, which specifies that the packet print process should use Postscript to generate a better print.

Print to

This field contains another pair of mutually exclusive radio buttons:

•Command, which specifies that a command be used for printing.

•File, which specifies that printing be done to a file.

Command

This field specifies the command to use for printing. It is typically lpr. You would change it to specify a particular queue if you need to print to a queue other than the default. An example might be:

lpr -Pmypostscript

85