[Guy Harris <guy@xxxxxxxxxxxx>]

On Sep 18, 2003, at 10:55 AM, Greg Morris wrote:

> The filter is created as
>  
> ipx.node==043432.000000000001.
>  
> This is invalid s/b
>  
> ipx.net==043432 AND ipx.node==00:00:00:00:00:01

Unfortunately, that breaks the current assumption in the conversations 
list code that the filter for a given address is of the form "{field} 
== {value}", i.e. that for all protocols there's a single field 
corresponding to the address.

I see a couple of ways of fixing this:

	1) make that assumption true, by adding a possibly-hidden field - 
which would either have to be an FT_BYTES field or a new FT_IPXADDR (or 
FT_IPX) type;

	2) have per-address-type routines (or a single routine that takes an 
"address" structure as an argument) that return a filter of the 
appropriate type, and have the conversations list code call it.

1) has the potential advantage that you could filter on a full IPX 
address without having to combine an ipx.net and ipx.node expression.  
I don't know whether making it non-hidden is a good idea or not.

2) has the advantage that you could, I think, also use it in the code 
that handles "Match Selected" in the packet list pane.

Note that 1) and 2) aren't necessarily mutually exclusive - although 
either would suffice to solve the problem, the possible advantages that 
they offer in addition to solving the problem might make both worth 
doing.