On Sat, Jul 29, 2000 at 10:21:02AM +0900, Richard Sharpe wrote:
> I also note that if you specify a display filter string in the Capture
> Preferences dialog box, you get an error message :-)
Well, there are a couple of problems here:
1) we don't distinguish between display and capture filters;
2) the capture filter syntax is different from the display
filter syntax.
In the short term, we might want to distinguish between the two types of
filters, although that'd involve either
1) changing the format of the "filters" file to specify, for
each filter, which type of filter it is;
2) splitting the "filters" file into "capture_filters" and
"display_filters";
3) flagging filters only in memory, based on whether they pass
the display filter parser or not.
At some point I'd like to make the capture filter syntax a subset of the
display filter syntax, by translating that syntax into libpcap syntax -
I have the beginnings of some code to do that, but haven't worked on it,
as I have 1000 other things I'm also working on, and Gilbert has a
project to redo the display-filter parser using Lemon, and I've put off
working on the capture-filter parser awaiting Gilbert's rewrite so that
I can steal his new code rather than stealing his old code and then
stealing the new code later.
Once that's done, distinguishing between display and capture filters
becomes trickier, as many (ideally all) capture filters would also work
as display filters, and some display filters would also act as capture
filters.
