Wireshark · Ethereal-dev: Re: [Ethereal-dev] Some ideas about display filter expression

[Guy Harris <gharris@xxxxxxxxx>]

On Fri, Dec 28, 2001 at 11:45:41PM +0200, Paul Ionescu wrote:
> I was playing around with "Add expression..." from display filters and I
> think that we can do some minor improvements like:
> 
> Add at least two more buttons to the Filter Expression dialog like "and"
> and "or" besides "Accept" and "Close".

The Microsoft Network Monitor filter-expression-construction dialog
displays that filter expression as a tree; it has a similar UI (in fact,
the "Filter Expression" dialog box popped up by "Add Expression" is very
similar to the equivalent dialog box in Network Monitor, as I'd used the
NetMon dialog box as an inspiration), with buttons to add ANDs and ORs,
as well as NOTs.

It doesn't have a provision for typing in the expression as text, the
fact that it *does* have a textual syntax for them nonwithstanding
(if you save a filter expression, it's saved to a text file).

> Another thing should be another relation like "not present":
> if you select "not present" as a relation for a PROTOCOL, the result
> should  be "! PROTOCOL".

"is present" can be used for non-protocol fields as well, so presumably
that should work for *all* fields where you can test them for "is
present".

> And at last, there should be a field in the bottom of the dialog box,
> just before the buttons, where you can see the expression you made so
> far.

Which dialog box?  The dialog box with the list of named filters (as
popped up by, for example, the "Filter:" button at the bottom of the
main window) *does* have such a field, the "Filter string:" field.