Ethereal-dev: Re: [Ethereal-dev] RE: Fix: Display-Filter: substring operator for text

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxx>
Date: Mon, 10 Mar 2003 14:38:14 -0800
On Mon, Mar 10, 2003 at 10:54:24PM +0100, Stefan Wenk wrote:
> In the attachment you find an enhancement of the SIP dissector, which allows
> dynamic filtering on header fields.

Checked in (with some C++isms, and possibly also C99isms, removed, e.g.
C++-style quotes, and declarations in the middle of a {}-surrounded body
of code).

> But this remains a question:
> It seems FT_STRING can be checked for text under quotes, but not with
> substrings.

We don't do substring matching in Ethereal display filters, if by that
you mean a filter expression that checks whether a given field
contains a given string.

Or do you mean you can't specify a range for an FT_STRING field and
compare it with a text string in quotes (i.e., checking whether a
specific part of a field matches a string)?

> I find the display filter GUI also a bit confusing, because it displays
> "Value (Character String)" also for ranges, although this can't be used
> afterwards.

What do you mean by "displays 'Value (Character String)' also for
ranges"?  Fields aren't ranges - you can have a range *of* a field.

Do you mean "it doesn't remove the '(character string)' if you put
something into the 'Range (offset:length)' box"?