Maynard, Chris wrote:
Is there a way to get the count of the number of times a display filter
is true? We have protocols that encapsulate multiple higher layer
protocols such that the number of packets left displayed after the
display filter is run does not necessarily correspond to the number of
matches to that filter. It is not that important how many packets are
displayed, but how many matches there are.
The filter code acts on each packet in the packet list, and either
matches or doesn't match; it doesn't know anything about a packet at one
level containing multiple packets at another level, so it has no concept
of there being more than one match for a packet.
