Wireshark-dev: Re: [Wireshark-dev] Display filter count?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 20 Nov 2006 16:40:52 -0800
Maynard, Chris wrote:

Is there a way to get the count of the number of times a display filter
is true?  We have protocols that encapsulate multiple higher layer
protocols such that the number of packets left displayed after the
display filter is run does not necessarily correspond to the number of
matches to that filter.  It is not that important how many packets are
displayed, but how many matches there are.
The filter code acts on each packet in the packet list, and either matches or doesn't match; it doesn't know anything about a packet at one level containing multiple packets at another level, so it has no concept of there being more than one match for a packet.