Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-dev: Re: [Ethereal-dev] RE: Fix: Display-Filter: substring operator for text

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxx>
Date: Mon, 10 Mar 2003 14:38:14 -0800
On Mon, Mar 10, 2003 at 10:54:24PM +0100, Stefan Wenk wrote:
> In the attachment you find an enhancement of the SIP dissector, which allows
> dynamic filtering on header fields.

Checked in (with some C++isms, and possibly also C99isms, removed, e.g.
C++-style quotes, and declarations in the middle of a {}-surrounded body
of code).

> But this remains a question:
> It seems FT_STRING can be checked for text under quotes, but not with
> substrings.

We don't do substring matching in Ethereal display filters, if by that
you mean a filter expression that checks whether a given field
contains a given string.

Or do you mean you can't specify a range for an FT_STRING field and
compare it with a text string in quotes (i.e., checking whether a
specific part of a field matches a string)?

> I find the display filter GUI also a bit confusing, because it displays
> "Value (Character String)" also for ranges, although this can't be used
> afterwards.

What do you mean by "displays 'Value (Character String)' also for
ranges"?  Fields aren't ranges - you can have a range *of* a field.

Do you mean "it doesn't remove the '(character string)' if you put
something into the 'Range (offset:length)' box"?