Ethereal-dev: Re: [Ethereal-dev] Can I reuse ett_xxxx variables for an arbitrary number of sub

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Lars Roland <Lars.Roland@xxxxxxx>
Date: Tue, 17 Aug 2004 01:43:02 +0200
Hello Kelly,

Kelly Byrd schrieb:


But, I think it would be useful for users to be able to filter on
daap.name == 'asal', but this would require that a reuse hf_daap_name
when I'm recursing to the contained tags, rather than just add them
as text labels. This is a similar question to my original ett_xxxx
reuse question, can I reuse header filed statics?
Yes, you can do that. The most famous example for this is "ip.addr". It is used for both the IP source and destination. 

There is only one thing to remember:
"ip.addr != 10.0.0.1" is equal to
"(ip.src != 10.0.0.1)||(ip.dst != 10.0.0.1)"

"!(ip.addr == 10.0.0.1)" is equal to
"!((ip.src == 10.0.0.1)||(ip.dst == 10.0.0.1))"

You see the difference.
So if you look for a packet without any field of daap.name equal to 'asa1', you have to filter on "!(daap.name == asa1)". "daap.name != asa1" gives you any packet with at least one field of daap.name not equal to 'asa1'. 

Best Regards,
Lars