Wireshark-dev: [Wireshark-dev] The 'in' display filter operation
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Jeffrey Smith <whydoubt@xxxxxxxxx>
Date: Sat, 22 Aug 2015 22:11:06 -0500
I decided to try my hand implementing the 'in' operator.  I used the syntax 'x in {a,b,c}' (with commas).  In code I created a set type that contains a GSList of stnode_t's.  At the gencode layer, I effectively generate an OR-ed series of equality operations, but I cut out the redundant existence operations.  The DFVM was untouched.

After doing this, I ran across doc/README.display_filter which proposes various implementations for the 'in' operator.  Also, it mentions this issue has been brought up at least as far back as 2004.  So what are the current thoughts on this?  Any significant reason that no implementation has made it in?

It would be trivial for me to change to the 'x in {a b c}' syntax (no commas) if that is preferred.  However, I have not done any work toward handling contiguous ranges and have no plans to at present.

 -- Thanks,
 -- Jeff Smith