Wireshark · Ethereal-dev: Re: [Ethereal-dev] counting labeled FT_NONE in a tree?

[Guy Harris <guy@xxxxxxxxxx>]

On Tue, Aug 06, 2002 at 05:37:25PM -0400, Khachaturov Vassilii wrote:
> Suppose I want to select just thouse frames which contain more than 1
> inner frame. I would like to use 'inner' as a counter - so that (inner > 1) 
> would select me what I want. Do you think it is a conceptually wrong
> idea if I try to make a patch for ethereal to "upgrade" the boolean here
> (does a label appear?) to an unsigned integer (how many times does it
> appear?)?

As per my other mail, "inner" is *not* a Boolean, it's an FT_NONE, so
it's not something to upgrade from a Boolean to a count.

If you really want to be able to test how many instances of an arbitrary
field appear in a packet, the right way to do it might be to add, for
example, a "count" operator, e.g.

	count(outer.inner) > 1

Doing just

	outer.inner > 1

would be a really gross hack; FT_NONE and FT_PROTOCOL fields don't have
values, and "overloading" them to have a "value" equal to the number of
instances of the field is a special-purpose hack *AND* doesn't
generalize to fields that *do* have values - if you're going to let
people test how many instances there are of a field, you might as well
let them do that on *any* field.