Wireshark · Ethereal-dev: Re: [Ethereal-dev] Problems capturing on networks other of my own?

[Gilbert Ramirez <gilramir@xxxxxxxxx>]

Yaniv Kaul wrote:
> 
> 
> Also, I suspect 'present' for RST flag in TCP as a display filter does not
> work. I had to use ==1 to get the filter working correctly.
> 

The way the display filter code deals with boolean field types
changed in 0.8.16.  Now, for all field types, "field" tests for
the existence of that field in the protocol tree, while "field ==
value",
of course, test for both existence and equivalence.

Before 0.8.16, "field", if the field was a boolean field, would
actually test "field == 1". It was convienent, but not congruent
with the rest of the syntax.

One could argue that "field" should test for existence, and if
the field exists, for a non-zero value. But what about IP
addresse that are 0.0.0.0 ? We'd have to implement a separate
exists() operator to test purely for existence.

(note, in the very very first implementation of display filter,
many moons ago, "exists" was a separate operator).

--gilbert