Wireshark · Wireshark-dev: Re: [Wireshark-dev] Display Filter Macros of currently selected packet fields?

["Luis EG Ontanon" <luis.ontanon@xxxxxxxxx>]

don't bother... cf_select_packet() is the place I was looking for

On 7/30/07, Luis EG Ontanon <luis.ontanon@xxxxxxxxx> wrote:
> Where in gtk/*.c a packet gets selected?
>
>
> On 7/25/07, Luis EG Ontanon <luis.ontanon@xxxxxxxxx> wrote:
> > On 7/25/07, Ulf Lamping <ulf.lamping@xxxxxx> wrote:
> > > Luis EG Ontanon schrieb:
> > > > On 7/25/07, Luis EG Ontanon <luis.ontanon@xxxxxxxxx> wrote:
> > > >
> > > >> If we consider this dynamic condition that a filter can be correct or
> > > >> incorrect depending on when it is compiled this is feasable (and a
> > > >> nice feature too!)...
> > > >>
> > > >
> > > > One last thing I will have to redissect the selected frame each time a
> > > > the filter is entered...
> > > >
> > > > how do I do that?
> > > >
> > > Without having a look at the code: I would think that's done mostly the
> > > same way when a packet is selected in the packet list today.
> > >
> > > But do you really have to redissect the packet? The protocol tree for
> > > the selected packet is already existing, so scanning the filter string
> > > for the field names and replacing them with the current values might
> > > simply work, but I'm probably too optimistic here ;-)
> >
> > Yes you are optimistic... "the tree" would belong to the last
> > dissected packet... which often is the selected one but there are
> > cases (e.g. live capture) where "the tree" is not the one of the
> > selected frame.
> >
> > However I thought that what I have to do is to "cache" the represented
> > strings when the packet is selected and somehow pass that cache to the
> > dfmacro engine.
> >
> > I think these "dynamic-macros" will be $[field.name] using '['
> > instead of '{'  for these will make everything much simpler.
> >
> >
> > > Regards, ULFL
> > > _______________________________________________
> > > Wireshark-dev mailing list
> > > Wireshark-dev@xxxxxxxxxxxxx
> > > http://www.wireshark.org/mailman/listinfo/wireshark-dev
> > >
> >
> >
> > --
> > This information is top security. When you have read it, destroy yourself.
> > -- Marshall McLuhan
> >
>
>
> --
> This information is top security. When you have read it, destroy yourself.
> -- Marshall McLuhan
>


-- 
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan