Wireshark · Ethereal-dev: [Ethereal-dev] Display filter engine questions

["Olivier Biot" <ethereal@xxxxxxxxxx>]

Hi list,

I'd appreciate if someone could give me some insights on the display
filter engine I currently don't have. The reason for this is that I
plan to work on some extra display filter operations, but I don't know
for now where to do what :)

There is a grammar.lemon file and a scanner.l file. Could someone tell
me what is in what, and which gets used when in parsing a display
filter?

For instance, if I wan to add an 'in' display filter operation, I need
to define several things. This can happen in different ways. For
instance, every value from the "in" value collection will result in a
test. There are 2 options here, either a test for a single value (x in
{a b c}), or a test for a value in a given range (x in {a ... z}). The
former can be reduced to "((x == a) or (x == b) or (x == c))" while
the latter can be reduced to "((x >= MIN(a, z)) and (x <= MAX(a,
z)))".

I understand that I can replace "x in {" with the following steps:
first store x in the "in" test buffer, then add "(" to the display
filter expression internally.

Similarly I can replace the closing brace "}" with the following
steps: release x from the "in" test buffer and then add ")" to the
display filter expression internally.

How could I do this?

Regards,

Olivier