Wireshark · Ethereal-dev: Re: [Ethereal-dev] (no subject)

["Olivier Biot" <ethereal@xxxxxxxxxx>]

From: Richard Sharpe

| Hi,

[snip]

| Now, I notice that if you right-click when you are over the proto
column
| and select match-->selected, it does not build a display filter
| expression, while if you right-click when over Destination or etc,
it
| does.
|
| Now, this would seem to be because the if expression above is false,
so
| perhaps cfile.cinfo.col_expr has not been set up for the proto
field.
|
| Hmmm, but perhaps what I could do is check if it is the proto field,
and
| if so, simply return the value from that column ... that might work.

The proto column is not *the* protocol used, but *a* protocol present
in the packet. There is no reference to the protocol which has set the
column value, so it is not "possible" to build a display filter based
on the proto column.

| We would not want to use the info field, however.

Agreed, as the Info field only contains a sort of summary which has
been set by potentially all protocols in the packet. As a matter of
fact, the explanation on the 'Protocol' column also applies to the
'Info' column, so the 'however' in your sentence should be read as
'either' :)

Regards,

Olivier