Wireshark · Ethereal-dev: Re: [Ethereal-dev] 'Add Expression' button in 'Edit Capture Filter' window ?

[Guy Harris <guy@xxxxxxxxxx>]

On Thu, Dec 12, 2002 at 02:17:03PM -0500, Devin Heitmueller wrote:
> I thought it was not added because the capture filters have far less
> granularity than the display filters.

I added that dialog box to the display filter because there are a
zillion fields that can be filtered and I can't remember all of them.

As you note, there aren't as many things that can be filtered with capture
filters; the syntax of capture filters is also not as simple as the
syntax of display filters - the primitive operations in display filters
are of the form

	{field name}

checking for the presence of the field, or

	{field name} {relational operator} {value}

testing the value of the field (plus subrange versions of that).  The
capture filter syntax doesn't include relational operators in the
built-in operations (it's "host foo", not "host == foo"), and there are
protocol qualifiers ("ip host foo", "ip6 host foo") that cause "host" to
refer to particular types of addresses, etc., so "Add Expression"
wouldn't necessarily be as simple as it is for display filters.

Somebody might write such a dialog box some day.  I know of nobody
planning to do so.