Wireshark · Ethereal-dev: Re: [Ethereal-dev] Need for an 'in' dfilter operator?

["Guy Harris" <gharris@xxxxxxxxx>]

Biot Olivier said:
> Is there any interest in adding a 'in' display filter operator allowing
> short-hand "field in (x1 x2 ... xN)" for a lengthy "(field eq x1 or
> field eq x2 or ... or field eq xn)"?

"eq" for IPv4 and IPv6 addresses arguably should be implemented as "in",
at least if it's something such as "ip.addr eq www.microsoft.com", as
"www.microsoft.com" (once you go through the two CNAME mappings) resolves
to 8 different Akamai addresses.  The libpcap capture filter "host
www.microsoft.com" compiles into a test of all those addresses; a display
filter probably should do so as well.