Wireshark · Wireshark-dev: Re: [Wireshark-dev] Regarding Modification of Display Filters

["Gilbert Ramirez" <gram@xxxxxxxxxxxxxxx>]

Is the 2nd protocol known before hand? If so, then I don't understand
why the display filter has to me modified on the fly.

Can you describe the situation a bit more?

Wouldn't it be something like:

(other part of display filter) and (if proto1 then "|| proto2" )

in which case, you could say:

(other part of display filter) and ( (not proto1) or (proto1 and proto2) )

right?

--gilbert

On 5/30/07, purandhar.krishnamurthy@xxxxxxxxxxxxxxxxxxxx
<purandhar.krishnamurthy@xxxxxxxxxxxxxxxxxxxx> wrote:
> Hi,
>
> I would like to create a conditional display filter.  When a filter
> criteria is hit on one protocol I would like to change the display filter
> so that it includes an OR'd reference to another protocol.  How can I
> update the wireshark code to modify a display filter on the fly ?
>
> Thanks in advance,
> Purandhar Krishnamurthy.
> _______________________________________________
> Wireshark-dev mailing list
> Wireshark-dev@xxxxxxxxxxxxx
> http://www.wireshark.org/mailman/listinfo/wireshark-dev