how to customize the filter when following a stream in wireshark?
- by jim
when selecting a packet and choosing to follow the stream, wireshark automatically sets a filter that looks something like this: (ip.addr eq 10.2.3.8 and ip.addr eq 10.2.255.255) and (udp.port eq 999 and udp.port eq 899). i'd like to be able to set that myself when following the stream, but have not been able to identify where to do that. setting the display filter has no effect. in fact, after following the stream, whatever display filter is currently set will be replaced by the follow stream formatted filter.
is customizing the follow stream filter even possible? thanks