Wireshark · Wireshark-dev: Re: [Wireshark-dev] Wish: Mark/Find the element matching the display filter

[Guy Harris <guy@xxxxxxxxxxxx>]

Stephen Fisher wrote:

> My bad, it does work as I had intended.  It highlights the field (with
> the function highlight_field()) whenever you do a hex or string search,
> but not when you do a filter search.  Should we add filter search
> matches too?

I'd say "yes" - if a search pattern of any sort matches a packet because 
it matches a particular field in the packet, it should highlight the 
matching field regardless of the type of the match.

That does raise an interesting question - if a pattern matches *more 
than one* field in a packet, should "find next" find the next instance 
that matches, even if it's in the same packet, or should it find the 
next instance in that packet and, if there is no next instance in that 
packet, search subsequent packets?  There are probably places where the 
former is useful and places where the latter is useful.