I've been playing around a bit with the Match Selected popup menu from
the dissection frame (second frame down in the gtk ethereal gui).
When I highlight a syntactical element in a DNS packet (for example) in
the dissection frame ( like the "Transaction ID") the corresponding tag
is displayed in the grey textbox in the lower right (like
"Identification of transaction (dns.id)" ). When I bring up the
pop up menu by right clicking on the previously selected field in
the dissection frame and select "Match Selected" it sets the filter
equal to whatever the syntactical tagging was for the selected frame
(like "dns.id == 0x94f0").
When I atttempt to do something similar with the MGCP plugin
(like selecting the "Verb" field from the dissector frame) I get
correct information displayed in the grey textbox in the lower right
corner ( like "Name of verb (mgcp.req.verb)") but an attempt to "Match
Selected" yields a filter which refers to the frame
( like "frame[42] == 43:52:43:58" ). Am I failing to do something
in my dissector? Is there some simple action which one must take to
enable correct "Match Selected" behavior?
Ed
