searching for multiple destination ports

[allenhau]

I have a search query for:

dest_port=4402

I want to include 4404.  what would the syntax for dest_port look like?

[eddy_liang]

Works. But how do you clean it up where it returns just a single line to show both ports. It's currently showing multiple lines for each different port.

[anilchaithu · Accepted solution]

@allenhau 

Use either one of the below in your base search

OR command

dest_port=4402 OR dest_port=4404

IN command

dest_port IN (""4402 4404"")