On Feb 11, 2004, at 2:18 AM, Guy Harris wrote:
It might be that the number of token types should be reduced,
Or it might be that the rule for existence tests should allow an
entity, rather than just a field, to be used, and that the semantics
check phase should check whether an existence test is testing a field,
rather than a string, an unparsed token, or a range.
I've checked in a change to do that; the filter expression "weebl" now
reports
"weebl" is neither a field nor a protocol name.
rather than
Unexpected end of filter string.
The filter expression "eth[3:2]" reports
You cannot test whether a range is present.
rather than
Unexpected end of filter string.
but I think one could argue that it should report neither - instead, it
should compile to a display filter that returns true if the "eth" field
has at least 2 bytes starting at an offset of 3 and false otherwise.
I.e., you're asking whether those bytes exist.
Does that make sense?
BTW, the filter expression
"what the heck
*without* a closing quote is considered syntactically legal, and the
resulting filter doesn't appear to reject any packets. The phrase that
comes to mind is, well, "what the heck?".