Wireshark · Ethereal-dev: Re: [ethereal-dev] cvs commit: ethereal packet-aarp.c

[Guy Harris <guy@xxxxxxxxxx>]

> Not when I tried it - I got
> 
> 	Unable to parse filter string "ip.addr == cable19-003.gte.net"
> 
> when I tried using that filter expression on a file with packets labeled
> as coming from or going to "cable19-003.gte.net"  (i.e., it should've
> been able to resolve that address).

Unfortunately, it appears that "dfilter_mknode_ipv4_value()" is being
called with "cable19" as an argument, not "cable19-003.gte.net"; you
probably need to make the "looks like a protocol or field name" case
accept "\-", as RFC 1034 says that host names can include, as characters
other than the first character, letters, digits, or hyphens.

This patch appears to fix that problem (and also fixes the comment):

Index: dfilter-scanner.l
===================================================================
RCS file: /usr/local/cvsroot/ethereal/dfilter-scanner.l,v
retrieving revision 1.13
diff -c -r1.13 dfilter-scanner.l
*** dfilter-scanner.l	1999/10/04 18:09:04	1.13
--- dfilter-scanner.l	1999/10/06 18:17:35
***************
*** 139,145 ****
  }
  
  
! [A-Za-z][A-Za-z0-9\.\_]+	{	/* looks like a protocol or field name */
  
  	int retval = 0;
  	enum ftenum ftype;
--- 139,145 ----
  }
  
  
! [A-Za-z][A-Za-z0-9\.\_\-]+	{	/* looks like a protocol, field name, or host name */
  
  	int retval = 0;
  	enum ftenum ftype;