Wireshark-dev: [Wireshark-dev] How does wireshark filter packets
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Wenfei Wu <wenfeiwu@xxxxxxxxxxx>
Date: Tue, 29 Jan 2013 15:39:27 -0600
Hi, all,
  I want to know how wireshark use the filter _expression_ to filter packets. Does it parse the packet first, and then use the filter _expression_ to check? If so, is there some intermediate data structure to store the filter _expression_? What is the algorithm?
  Is there some materials about this?
  Regards,
  Wenfei Wu