[Khachaturov Vassilii <Vassilii.Khachaturov@xxxxxxxxxxxx>]

> As per my other mail, "inner" is *not* a Boolean, it's an FT_NONE, so
> it's not something to upgrade from a Boolean to a count.

thanks - that other one really shed the light on the matter I was missing

> If you really want to be able to test how many instances of 
> an arbitrary
> field appear in a packet, the right way to do it might be to add, for
> example, a "count" operator, e.g.
> 
> 	count(outer.inner) > 1
[snip]
> if you're going to let
> people test how many instances there are of a field, you might as well
> let them do that on *any* field.

You are certainly right, this both looks better and will also not slow
down as much the main branch for the people who don't need the counting
in their filter - 99.99% filters at least I'd guesss.

Thanks for the clarifications,
v.