Guy Harris wrote:
> The Microsoft Network Monitor filter-expression-construction dialog
> displays that filter expression as a tree; it has a similar UI (in fact,
> the "Filter Expression" dialog box popped up by "Add Expression" is very
> similar to the equivalent dialog box in Network Monitor, as I'd used the
> NetMon dialog box as an inspiration), with buttons to add ANDs and ORs,
> as well as NOTs.
Yes, I know that MS have these, so I wanted to have them in ethereal
too.
I shouldn't be so hard, just append the string " OR " or " AND " at the
end of current expresion and reiterate the process.
In the end we will have some expressions connected by " OR " and " AND
".
> "is present" can be used for non-protocol fields as well, so presumably
> that should work for *all* fields where you can test them for "is
> present".
Totaly agree.
So "not present" should work also for *all* fields where you can test
them for "not present" with ! in front of it.
Something like "! proto.field.subfield" ...
> > And at last, there should be a field in the bottom of the dialog box,
> > just before the buttons, where you can see the expression you made so
> > far.
>
> Which dialog box? The dialog box with the list of named filters (as
> popped up by, for example, the "Filter:" button at the bottom of the
> main window) *does* have such a field, the "Filter string:" field.
No, I was thinking at Filter expression window, the window that appears
when you press "Add Expression ..." button.
In this stage is almost useless, but if you have done multiple
"and"/"or"'s you may forget what you have done so far.
It should be just before Accept/Close/[And]/[Or] buttons, where [And]
and [Or] are the buttons we are talking about in the begining of the
e-mail.
Anyway, I am not so good at GTK+, so I will not do the patch :(