[Wenfei Wu <wenfeiwu@xxxxxxxxxxx>]

Hi, all,

  I want to know how wireshark use the filter _expression_ to filter packets. Does it parse the packet first, and then use the filter _expression_ to check? If so, is there some intermediate data structure to store the filter _expression_? What is the algorithm?

  Is there some materials about this?

  Regards,

  Wenfei Wu