|From: Martin Regner
|
|Wes wrote
|> I noticed with release 0.10.3 Ethereal:
|>
|> "Display filters now support the bitwise and (&)
|> operator."
|>
|> This sounds like it might allow me to do the binary
|> display filter I was looking for, but I haven't been
|> able to find any description or example how to use it.
|> I tried some variations like below, but it didn't seem
|> to work.
|>
|> rtp.payload[4] and 2 == 0
|>
|> I am not a programmer and I'm probably missing
|> something obvious.
The HTML help pages of the Win32 build of Ethereal 0.10.3 are broken. Hence
you won't find much information in those.
|> Can someone provide any insight on what this feature
|> is and how to use it?
|The "bitwise and" operator is "&" or "bitwise_and"
|
|However it seems not currently possible to do a filter like
|"rtp.payload[4] & 2 == 0".
|
|Maybe the following filter will work for what you want to do:
|rtp.payload and !(rtp.payload[4] & 2).
This is correct. Today a display filter expression returns a boolean, so the
example "rtp.payload[4] & 2 == 0" is interpreted as:
1. (rtp.payload[4] & 2) ==> { True, False }
2. { True, False } == 0 ==> Syntax Error (today at least)
Think of a display filter expression as a *boolean* expression. Every test
you write WILL/MUST return True/False.
Regards,
Olivier