Wireshark · Ethereal-dev: Re: [Ethereal-dev] counting labeled FT_NONE in a tree?

[Guy Harris <guy@xxxxxxxxxx>]

On Tue, Aug 06, 2002 at 06:00:12PM -0400, Khachaturov Vassilii wrote:
> > I am unhappy about this. It only works if everybody does 
> > "inner++" instead of "inner=TRUE". The latter is the more 
> > sensible thing to do for a boolean value.
> 
> I am definitely an ethereal newbie, but my impression was that 
> a dissector never specifically assigns any booleans like that.
> Instead, the moment when a protocol dissector is called,
> it's "protoname" filter automatically triggers.
> 
> Same thing seems to happen when an FT_NONE is added - 
> the filter (named as described) in the associated hf registration info - 
> is triggered.

The "protoname" fields aren't Booleans.  A Boolean is a field of type
FT_BOOLEAN, and they really *are* specifically assigned.

A filter expression that tests a Boolean compares it with 1 or 0, e.g.

	ip.tos.delay == 1

A filter expression that gives a field name, but no comparison operator,
is testing for the presence or absence of that field, not whether it's
"true" or "false".  That type of filter expression works for *all* types
of fields, but only tests whether the field is present or absent, it
doesn't test the value of a field.