Wireshark-dev: Re: [Wireshark-dev] Display Filter Macros of currently selected packet fields?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "Luis EG Ontanon" <luis.ontanon@xxxxxxxxx>
Date: Wed, 25 Jul 2007 02:08:28 +0200
On 7/24/07, Luis EG Ontanon <luis.ontanon@xxxxxxxxx> wrote:

The issue is: first, last, or a middle one?
the lack of a good answer to that question is the reason that feature
is not yet there.


A good answer can be: in that case we fail with an "macro can have
more values" error.

Still there are more issues that come:

Such a macro would yield an error "non existent value" when there's no
capture open, so there's no current frame, idem for tshark.
And that would happen yet again if such a macro is used for a color filter.
And yet again that would happen if the selected frame does not have an
${eth.src} value (an MTP3 capture).

If we consider this dynamic condition that a filter can be correct or
incorrect depending on when it is compiled this is feasable (and a
nice feature too!)...

--
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan