DFTEST(1)

💖 DFTEST(1) — the manual page, but make it cute 💖

okay bestie, pull up a chair 🎀 this is dftest, and it lives in the section 1 of the manual (that's the "commands you actually type" section, iykyk). it's a whole little icon and it's about to show you the secret inner life of your display filters ✨

---

✨ NAME ✨

dftest — shows display filter byte-code, for debugging dfilter routines.

like. it's the x-ray machine for your filters. no cap. 🦋

---

🌸 SYNOPSIS 🌸

dftest [ <filter> ]

that's it. that's the whole vibe. one optional lil filter and she's off 💅

---

💜 DESCRIPTION 💜

so here's the tea, bestie: dftest is a simple tool that compiles a display filter and then shows you its bytecode. that's the whole job. she compiles, she spills, she leaves. main character energy fr fr 👑

if you wanna actually understand the bytecode she's showing you, go read doc/README.display_filter — it has a description of the DFVM (Display Filter Virtual Machine) Byte Codes. yes it's a whole virtual machine. for filters. we love a niche queen. 💖

---

💅 OPTIONS 💅

• filter — the display filter expression. heads up though: if it needs it, it has to be quoted. don't come crying to me when your shell eats your asterisks 🫶

---

🔥 DIAGNOSTIC OPTIONS 🔥

okay so this is the part where she gets chatty. logging options, go:

• --log-level <level> — set the active log level. the supported levels, going lowest to highest, are "noisy", "debug", "info", "message", "warning", "critical", and "error". messages at each level and higher get printed, so for example "warning" prints "warning", "critical", and "error" messages, and "noisy" prints all the messages. levels are case insensitive, so type it however your heart desires ✨
• --log-fatal <level> — abort the program if any messages are logged at the specified level or higher. for example, "warning" aborts on any "warning", "critical", or "error" messages. she said we're DONE here 💀
• --log-domains <list> — only print messages for the specified log domains, e.g. "GUI,Epan,sshdump". the list of domains must be comma-separated. no spaces, bestie, she's picky 🎀
• --log-debug <list> — force the specified domains to log at the "debug" level. list of domains must be comma-separated.
• --log-noisy <list> — force the specified domains to log at the "noisy" level. list of domains must be comma-separated. maximum yapping, enabled. 🗣️
• --log-file <path> — write log messages and stderr output to the specified file. everything goes in the journal 📓✨

---

🦋 EXAMPLES 🦋

wanna see how the IP protocol is filtered? say less:

dftest ip

wanna see how frame 150 is filtered? obsessed:

dftest "frame.number == 150"

see that quote? that quote is doing WORK. protect it at all costs 💖

---

🌈 SEE ALSO 🌈

• wireshark-filter(4) — her big sister, the legend herself 👑

---

💖 AUTHORS 💖

Original Author

Jan Šafránek

Contributors

Jaap Keuter

---

and that's the whole page, bestie!! 🎀 this version of DFTEST(1) is dated 2026-05-03, and yeah, the page name is literally just DFTEST(1) again because manpages love a little redundancy moment. slay, stay filtered, and always quote your expressions 💅✨🫶