[Guy Harris <guy@xxxxxxxxxx>]

On Mon, Jul 29, 2002 at 03:53:11PM -0600, John McDermott wrote:
> Another option might be (the less effecient scheme of) creating a 
> mechanism so that each slot in the window corresponds to a filter.

Preferably either a capture filter, or a choice of a capture or a
display filter, as capture filters are much cheaper to evaluate than
display filters.

(Yes, I know, display filters are much nicer than capture filters, but
they're a bit heavyweight, as you have to parse the entire packet to
evaluate them, currently.

There might be ways to optimize that, so that as soon as enough terms in
the filter have been evaluated to make it certain whether the expression
is true or false, you quit dissecting the packet if you don't have other
reasons why you have to finish dissecting or, or you at least quit
constructing the protocol tree, but we don't have that in place.)