Tracer filters

A filter keeps rows whose message fields satisfy a condition. It applies to the selected Tracer view; capture, saving and Monitor are independent of it. A filter expression is the condition you type in Filter expression.

Cheat sheet

In this table, field, flag, text and data are placeholders, not application fields. Replace them with fields from the catalog for your layer.

Construct	Short example	Purpose
==, !=	field == 7, field != 7	Equality and inequality of compatible types
<, <=, >, >=	field < 10, field <= 10, field > 0, field >= 1	Integer comparisons
and, or, not	field == 7 and flag == true, field == 7 or field == 8, not (flag == true)	Logical conditions
in (...)	field in (1, 2, 3)	One of the listed values
contains	text contains "label", data contains [0x22, 0xF1]	Substring or contiguous byte sequence
exists(...)	exists(field)	Whether a message has the field
[index]	data[0] == 0x22	Individual byte, zero-based
( ... )	flag == true and (field == 1 or field == 2)	Grouping conditions

See Operators for precedence and alternative notation. If some messages lack a field, check the missing-value rules.

Select the field catalog

Profile and layer	Available fields	Reference
CANopen / VAG, Physical	trace.*, can.*	CAN
Modbus RTU	modbus.*	Modbus RTU
CANopen, Protocol	protocol.type, canopen.*	CANopen
VAG, Transport	protocol.type, isotp.*, tp20.*	Automotive VAG
VAG, Protocol	protocol.type, uds.*, kwp.*	Automotive VAG

The asterisk denotes a field group in this guide, not expression syntax. Despite their generic names, trace.* fields are currently available only on the source CAN layer.

One expression cannot combine different layers. For example, can.id cannot be used on the Protocol layer with uds.service. Expressions on the VAG Protocol layer may combine uds.* and kwp.* because both belong to that layer's catalog. Fields of the other protocol are absent from an individual row.

Entering expressions

Type a filter expression in Filter expression. A valid expression applies after a short typing pause; Enter applies it immediately.

• Ctrl+Space: open suggestions.
• Up and down arrows: select a suggestion.
• Enter or Tab with the list open: accept the suggestion.
• Esc: close suggestions.
• Empty input: remove the expression filter.

After ==, != and inside in (...), suggestions show known values for the selected field. Numeric fields also offer suggestions after <, <=, > and >=; string fields after contains. The typed prefix narrows the list: after protocol.type == u, press Tab to accept uds.

Completion also works inside quotes: can.frameType == "e suggests "ext". Suggestions also use quotes for strings that match keywords, such as direction "in".

Known values	Example fields	Suggestions
Boolean flags	can.fd, uds.positiveResponse, modbus.exception	true, false
String choices	can.frameType, isotp.frameType, canopen.type	Frame and message types from the field catalog
Service and error codes	uds.service, kwp.service, modbus.function, modbus.exceptionCode	Known hexadecimal codes
Sessions and commands	uds.session, canopen.nmtCommand	Known session and command codes

Enter addresses, labels and other free-form values manually. Numeric suggestions do not restrict accepted codes: you can type a value that is not listed.

Protocol type suggestions

protocol.type identifies the message's protocol on the selected layer, not a physical adapter. Accepted values are listed in the VAG and CANopen references.

Its suggestions reflect the current trace and layer. If the Transport layer contains only ISO-TP, only isotp is suggested. Switching to the Protocol layer shows application protocols. New types appear as messages arrive; after Clear, the cleared range no longer contributes. Applied filters and hidden TesterPresent messages do not narrow the list. In an empty trace the field remains available, but there are no value suggestions.

Manual input remains valid: protocol.type == kwp2000 is accepted before any KWP2000 messages appear. Other lists, such as isotp.frameType, come from the field catalog and are not limited by messages in the current trace.

If an expression does not apply

Invalid input produces a diagnostic. The last valid filter remains active: check Previous filter active. In VAG, the separate TesterPresent hiding option still applies when the expression is empty.

Types and literals

Type	Notation	Example
Integer	Decimal or hexadecimal with 0x	7, 0x7E0, 0xF190
Boolean	true or false	modbus.exception == true
String	Double quotes	can.frameType == "std"
Simple string value	May be unquoted after a comparison or in a set	canopen.type == pdo
Bytes	List of numbers from 0 to 255	[0x62, 0xF1, 0x90]

10 is decimal; hexadecimal ten is 0x0A. Use the exact case of field names and values from the reference. Keywords are lowercase. String comparisons and substring searches are case-sensitive. Do not replace canopen.nodeId with canopen.node_id or NodeId.

Operators

Precedence: comparisons, in and contains, then not, then and, then or. Parentheses make mixed conditions easier to read.

Example: a device address and a set of Modbus RTU functions.

modbus.unitId == 7 and modbus.function in (0x03, 0x04)

Example: an identifier format and a set of CAN IDs on the Physical layer.

can.frameType == std and can.id in (0x181, 0x185)

Example: a byte sequence within a UDS message on the VAG Protocol layer.

uds.data contains [0x62, 0xF1, 0x90]

Also accepted: in {1, 2}, byte notation hex"62 F1 90", and postfix field exists. This guide uses parentheses, byte lists and exists(field).

Missing fields

A missing field differs from zero, an empty string and false. Examples: a positive UDS response has no negative response code; a Modbus read response has no start address; an SDO segment may not carry an object index.

Comparisons with missing values are indeterminate. Only rows for which the entire expression is true are displayed. Therefore, uds.negativeResponseCode != 0x78 does not mean “everything except pending responses”: it also excludes messages without that field. Negating the comparison does not solve this.

To keep messages without a negative response code and responses with another code, test absence explicitly:

not exists(uds.negativeResponseCode) or uds.negativeResponseCode != 0x78

In mixed VAG traffic, this also keeps KWP2000 rows because they lack uds.negativeResponseCode. Restrict the result to UDS with protocol.type:

protocol.type == uds and (not exists(uds.negativeResponseCode) or uds.negativeResponseCode != 0x78)

For recognized UDS services only, use exists(uds.service):

exists(uds.service) and (not exists(uds.negativeResponseCode) or uds.negativeResponseCode != 0x78)

An out-of-range byte index, such as can.data[7] in a two-byte frame, also yields a missing value. An unknown field name is different: it is an expression error reported before filtering.

Language limits

A filter evaluates each frame or message of the selected layer separately. It does not automatically join a response to a matching request, calculate averages or create an event for a missing response. There is no arithmetic or “after the previous message” condition across messages.

Regular expressions, arithmetic and bitwise operators are not supported. Numeric fields are integers; fractional literals are not supported. The syntax is not claimed to be fully Wireshark-compatible.

Working with traffic: Modbus RTU, CANopen, VAG.