Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Regarding Modification of Display Filters

From: "Gilbert Ramirez" <gram@xxxxxxxxxxxxxxx>
Date: Wed, 30 May 2007 16:58:04 +0530
Is the 2nd protocol known before hand? If so, then I don't understand
why the display filter has to me modified on the fly.

Can you describe the situation a bit more?

Wouldn't it be something like:

(other part of display filter) and (if proto1 then "|| proto2" )

in which case, you could say:

(other part of display filter) and ( (not proto1) or (proto1 and proto2) )

right?

--gilbert

On 5/30/07, purandhar.krishnamurthy@xxxxxxxxxxxxxxxxxxxx
<purandhar.krishnamurthy@xxxxxxxxxxxxxxxxxxxx> wrote:
Hi,

I would like to create a conditional display filter.  When a filter
criteria is hit on one protocol I would like to change the display filter
so that it includes an OR'd reference to another protocol.  How can I
update the wireshark code to modify a display filter on the fly ?

Thanks in advance,
Purandhar Krishnamurthy.
_______________________________________________
Wireshark-dev mailing list
Wireshark-dev@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-dev