Ethereal-dev: [Ethereal-dev] Error in display filter grammar?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Olivier Biot" <ethereal@xxxxxxxxxx>
Date: Sat, 8 May 2004 16:05:09 +0200
Hi list,

I often have captures where HTTP traffic runs on non-standard ports.
In order to find the missing packets, I would intuitively use the
following display filter:

    !(http or tcp.reassembled_in) and tcp contains "HTTP/1."

However this seems to be understood as:

    ((!http) or tcp.reassembled_in) and tcp contains "HTTP/1."

The only workaround I have today is writing:

    !http and !tcp.reassembled_in and tcp contains "HTTP/1."

I think it has to do with the following rule in grammar.lemon:

    expr(X) ::= LPAREN expr(Y) RPAREN.
    {
        X = Y;
    }

Anyone a clue?

Regards,

Olivier