Wireshark-commits: [Wireshark-commits] Fwd: How does wireshark filter packets
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Wenfei Wu <wenfeiwu@xxxxxxxxxxx>
Date: Tue, 29 Jan 2013 16:20:41 -0600
maybe I should send it here.

---------- Forwarded message ----------
From: Wenfei Wu <wenfeiwu@xxxxxxxxxxx>
Date: Tue, Jan 29, 2013 at 3:39 PM
Subject: How does wireshark filter packets
To: wireshark-dev@xxxxxxxxxxxxx


Hi, all,
  I want to know how wireshark use the filter _expression_ to filter packets. Does it parse the packet first, and then use the filter _expression_ to check? If so, is there some intermediate data structure to store the filter _expression_? What is the algorithm?
  Is there some materials about this?
  Regards,
  Wenfei Wu