Ethereal-dev: Re: [Ethereal-dev] Need for an 'in' dfilter operator?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Guy Harris" <gharris@xxxxxxxxx>
Date: Tue, 20 Apr 2004 12:00:21 -0700 (PDT)
Biot Olivier said:
> Is there any interest in adding a 'in' display filter operator allowing
> short-hand "field in (x1 x2 ... xN)" for a lengthy "(field eq x1 or
> field eq x2 or ... or field eq xn)"?

"eq" for IPv4 and IPv6 addresses arguably should be implemented as "in",
at least if it's something such as "ip.addr eq www.microsoft.com", as
"www.microsoft.com" (once you go through the two CNAME mappings) resolves
to 8 different Akamai addresses.  The libpcap capture filter "host
www.microsoft.com" compiles into a test of all those addresses; a display
filter probably should do so as well.