Ethereal-users: Re: [Ethereal-users] display filter -- comparing a literal string value

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxx>
Date: Fri, 26 Apr 2002 14:03:21 -0700
On Thu, Apr 25, 2002 at 01:11:51PM +0100, Niall Mansfield wrote:
> I have never been able to get a display filter to test correctly for 
> a literal string value.  E.g.
> 	ftp.request.command == "LIST"
> matches no packets, even if I have created the filter using 
> menu Display > Match selected.

Have you tried any strings *other* than "ftp.request.command"?

There isn't a generic bug in the display filter code; there was a bug in
the FTP dissector where it was putting the entire request, not just the
command, into the protocol tree item for "ftp.request.command", but I
just checked in a fix for that, and, with that fix, "Display->Match
Selected" works fine on "ftp.request.command".

So what bugs you're seeing, at least in 0.9.3, are probably bugs
specific to particular dissectors, and we'd need to know what fields had
problems so we could fix those particular bugs.  (One exception is that
if the string *itself* contains quotes, "Display->Match Selected"
doesn't work right.  If backslash-escaping is supported in strings in
display filter expressions, we need to use it for quotes.)