[Richard Sharpe <rsharpe@xxxxxxxxxxxxxxxxx>]

On Sat, 21 Feb 2004, Olivier Biot wrote:

> | Hmmm, but perhaps what I could do is check if it is the proto field,
> and
> | if so, simply return the value from that column ... that might work.
> 
> The proto column is not *the* protocol used, but *a* protocol present
> in the packet. There is no reference to the protocol which has set the
> column value, so it is not "possible" to build a display filter based
> on the proto column.

Well, since the protocol column typically displays the bottom-level 
protocol, it seems to me that it would make most sense to simply build a 
filter based on that.

Eg, if the protocol column currently displays SMB, and I right click over 
that and select Match-->Selected, then I probably want to see only SMB 
packets.

Regards
-----
Richard Sharpe, rsharpe[at]richardsharpe.com, rsharpe[at]samba.org, 
sharpe[at]ethereal.com, http://www.richardsharpe.com