On Tue, Apr 8, 2008 at 2:46 PM, Sake Blok <sake@xxxxxxxxxx> wrote:
> BEWARE:
>
> "One important thing to note here is that the field that the calculation
> is based on MUST also be part of the filter string or else the calculation
> will fail."
>
> (from the manpage of tshark)
We ought to change that...
io,stat should prime the fields it uses by itself
either
by using proto_tree_prime_hfid(), that is: mark those fields as
interesting intead of asking the user to give dfilter_compile() a
filter to have them primed
or
easier (and dirtier) by simply appending "|| (!frame && df1 && df2 &&
df3 ...)" to the fiter being given.
Luis
--
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan