title: How to filter in Wireshark on a dynamic field name
body: <p>I have a protocol where the data payload is in a structured array. 
  example:</p>
  
  <pre><code>DataBlock 1:
     name: xxx
     city: xxx
     origin: xxx
  DataBlock 2:
     name: xxx
     city: xxx
     origin: xxx
  DataBlock 3:
     name: xxx
     city: xxx
     origin: xxx
  </code></pre>
  
  <p>and this is all within one frame in a Protocol named ServerBlocks...</p>
  
  <p>My wireshark filter to find all ServerBlocks is just </p>
  
  <pre><code>ServerBlocks
  </code></pre>
  
  <p>My filter to find name in DataBlock 3 is...</p>
  
  <pre><code>ServerBlocks.3.name
  </code></pre>
  
  <p>The problem i am having is i want to apply a wildcard to the field. I need this because i dont know what the index number is for name == 'John'</p>
  
  <p>What i am looking for is:</p>
  
  <pre><code>ServerBlocks.*.name == 'John'
  </code></pre>
  
  <p>The array in each ServerBlocks frame could be of different size so ill never know how many indexes there are to filter on. John could be index 1 or index X, but i just want to apply a display filter on ServerBlocks where one of the DataBlocks has name == 'John'</p>
  
  <p>I have looked in:
  <a href="https://wiki.wireshark.org/DisplayFilters" rel="nofollow noreferrer">https://wiki.wireshark.org/DisplayFilters</a> 
  and <a href="https://www.wireshark.org/docs/wsug_html_chunked/ChWorkBuildDisplayFilterSection.html" rel="nofollow noreferrer">https://www.wireshark.org/docs/wsug_html_chunked/ChWorkBuildDisplayFilterSection.html</a></p>
  
  <p>and havent found anything that could help. </p>
  
  <p>FYI:
  I am able to change the Lua defined ProtoField's so the array index doesnt need to be in the middle of the field but it could be at the end or the beginning too...example:</p>
  
  <pre><code>ServerBlocks.name.1
  </code></pre>
  
  <p>or</p>
  
  <pre><code>1.ServerBlocks.name
  </code></pre>
  
  <p>but even with this flexibility im unsure of how to filter properly so i can find where name == John without knowing the exact index </p>