Is their only 1 status fields in the frames that you are dissecting?
Thing to keep in mind is that your query below is not the same...
Example:
Frame 1: status=0, status=1
Frame 2: status=2
Frame 3: status=1, status=2
If you use "status != 2 && status != 0", all three frames will match.
But if you use "status == 1", only 1 and 3 will match.
Without knowing the particulars of the packet you're looking at, I
couldn't say. (Some protocols/ops result in multiple operations and
success/failure responses coming back in a single frame.)
-- Nathan
------------------------------------------------------------
Nathan Neulinger EMail: nneul@xxxxxxx
University of Missouri - Rolla Phone: (573) 341-4841
Computing Services Fax: (573) 341-4216
> -----Original Message-----
> From: Mike Frisch [mailto:mfrisch@xxxxxxxxxx]
> Sent: Thursday, August 08, 2002 11:33 AM
> To: John McDermott
> Cc: Ethereal-dev@xxxxxxxxxxxx
> Subject: Re: [Ethereal-dev] Colour filter issue
>
>
> On Thu, Aug 08, 2002 at 10:16:01AM -0600, John McDermott wrote:
> > Please try the same as a display filter. The code is the
> same. If it
> > works as a display filter, but not as a color filter,
> something strange
> > is going on. If neither works, it is a bug in the filtering code.
>
> It appears to be a bug in the filtering code. It does not work as a
> display filter either.
>
> The following 'equvalent' works:
>
> nfs.status == 1 or nfs.status > 2
>
> > Yes. I am not sure whether this was there from the
> beginning or was
> > introduced later. This needs to be fixed.
>
> I do not believe it has been there from the beginning as I
> just recently
> tripped on it.
>
> Thanks for the _prompt_ reply!
>
> Mike.
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>
