On Fri, 15 Dec 2000 05:29:27 -0500 (EST)
Ed Warnicke <hagbard@xxxxxxxxxxxxxxxxxxx> wrote:
> There seems to be a problem with filtering using the bootp.hw.addr
> attribute. A filter string of
>
> bootp.hw.addr == 00:09:27:92:2c:3b
>
> will yield a
>
> "Unable to parse filter string \"bootp.hw.addr == 00:09:27:92:2c:3b\""
>
> error dialog. The type of bootp.hw.addr is FT_BYTES. Does filtering in
> ethereal not work properly for FT_BYTES, or is something else broken?
>
> The same seems to hold true for the fields ntp.flags, and ntp.stratum,
> both of which are type FT_BYTES and both of which produce filter
> errors when you try to filter on them.
>
> Any thoughts?
The dfilter code allows byte comparisons on byte ranges, but not
on FT_BYTES variables. The following will work:
bootp.hw.addr[0:6] == 00:09:27:92:2c:3b
This is something that I need to fix. I'll take a look at it; I'm
currently dusting off the work I set aside a long time ago on dfilter
enhancements, so this came up at a good time.
thanks,
--gilbert
