Wireshark-dev: Re: [Wireshark-dev] Display Filter Macros of currently selected packet fields?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "Luis EG Ontanon" <luis.ontanon@xxxxxxxxx>
Date: Wed, 25 Jul 2007 02:46:34 +0200
On 7/25/07, Ulf Lamping <ulf.lamping@xxxxxx> wrote:

Luis EG Ontanon schrieb:
> On 7/25/07, Luis EG Ontanon <luis.ontanon@xxxxxxxxx> wrote:
>
>> If we consider this dynamic condition that a filter can be correct or
>> incorrect depending on when it is compiled this is feasable (and a
>> nice feature too!)...
>>
>
> One last thing I will have to redissect the selected frame each time a
> the filter is entered...
>
> how do I do that?
>
Without having a look at the code: I would think that's done mostly the
same way when a packet is selected in the packet list today.

But do you really have to redissect the packet? The protocol tree for
the selected packet is already existing, so scanning the filter string
for the field names and replacing them with the current values might
simply work, but I'm probably too optimistic here ;-)


Yes you are optimistic... "the tree" would belong to the last
dissected packet... which often is the selected one but there are
cases (e.g. live capture) where "the tree" is not the one of the
selected frame.

However I thought that what I have to do is to "cache" the represented
strings when the packet is selected and somehow pass that cache to the
dfmacro engine.

I think these "dynamic-macros" will be $[field.name] using '['
instead of '{'  for these will make everything much simpler.



Regards, ULFL
_______________________________________________
Wireshark-dev mailing list
Wireshark-dev@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-dev




--
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan