Ethereal-dev: Re: [ethereal-dev] Decoding multi-frame "packets"

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: guy@xxxxxxxxxx (Guy Harris)
Date: Sat, 12 Dec 1998 15:23:17 -0800 (PST)
> As Guy Harris said:
> > 
> > A display filter, to limit which of the packets are shown in the summary
> > view, can be constructed out of, among other things, relational
> > operations on properties - depending on the type of the property,
> > different relational operators are possible, such as "equals", "doesn't
> > equal", "greater than", etc..  One could, for example, say "show all ARP
> > packets where the 'Opcode' property equals 1", or "show all NFS ops
> > where the 'Filename' property equals 'hello_sailor.c'".  (Well, one
> > could if it let you specify a string value; it's not clear that it
> > does....)
> 
> (what's the "it" in "if it let you specify a string value"? libpcap?)

Microsoft Network Monitor - when I popped up the dialog box for
constructing the display filter, and selected the NFS property
"Filename", it offered the chance for comparisons against a byte value,
and defaulted to 0, suggesting that it's not clever enough to let you
type in a string.