[Ulf Lamping <ulf.lamping@xxxxxx>]

Jaap Keuter wrote:

>On Mon, 9 May 2005, Ulf Lamping wrote:
>  
>
>>Hmmm, it's not about RegEx here, but how to handle the combined fields
>>like ip.addr, tcp.port and alike.
>>
>>Currently we simply substitute "ip.addr" by "(ip.srcaddr ||
>>ip.destaddr)", which is ok for the == operator, but not really for the
>>!= operator.
>>
>>We might have a display filter "preprocessor", which converts this in a
>>way before handling the RegEx in it's current way.
>>
>>Or maybe simpler warn if the user types something like "ip.addr !=
>>1.2.3.4" that this is maybe not what he expects, as this string usually
>>won't make any sense.
>>    
>>
>
>Try to make that work on a complex expression. Not so easy.
>I would go for some more examples of these cases in the help tab "Display
>Filters", before sending them of into the online variant.
>  
>
Yes, having a second thought, the converting idea might not be easily
implemented.

However, by simply looking for filter patterns like "ip.addr !=" or "!=
ip.addr" (ignoring whitespace) and show up a warning should be easy to
add by a simple strcmp().

This might not be a hundred percent solution (could fail for complex
expressions), but far better than what we have now.

And it's about helping people to learn the first steps.

Regards, ULFL

P.S: Expecting that users have to read documentation is the worst way to
handle such problems. Reduce the learning curve is far better than that
and this topic is a *very frequent* problem...