Wireshark-bugs: [Wireshark-bugs] [Bug 552] Problems with display filters
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Thu, 14 Sep 2006 09:55:30 +0000 (GMT)
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=552





------- Comment #1 from jeff.morriss@xxxxxxxxxxx  2006-09-14 09:55 GMT -------
(In reply to comment #0)

> With the following display filters:
> nt.acb.disabled == 1
> nt.acb.pwnoexp == 0
> nt.acb.autolock == 1
> 
> the gui indicates an error (line displayed in red) when we choose one of the 
> nt.acb.* expression under DCERPC. Found with the menu Analyze -> Display 
> filters -> Expression.

The problem here _may_ be that those hf fields are declared as FT_BOOLEAN but
with a list of values:

~~~
                { &hf_nt_acb_disabled,
                  { "", "nt.acb.disabled", FT_BOOLEAN, 32,
                    TFS(&tfs_nt_acb_disabled), 0x0001,
                    "If this account is enabled or disabled", HFILL }},
~~~

Or maybe not, need access to a compiler to check...


-- 
Configure bugmail: http://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.