Wireshark · Ethereal-dev: Re: [Ethereal-dev] Need for an 'in' dfilter operator?

["Olivier Biot" <ethereal@xxxxxxxxxx>]

From: Guy Harris

| On Tue, Apr 20, 2004 at 11:38:06AM +0200, Biot Olivier wrote:
| > Is there any interest in adding a 'in' display filter operator
allowing
| > short-hand "field in (x1 x2 ... xN)" for a lengthy "(field eq x1
or field eq
| > x2 or ... or field eq xn)"?
|
| Would
|
| field in (x1-x2)
|
| also be useful for fields with a total order, e.g.
|
| tcp.port in (1000-1010)
|
| or even something such as
|
| udp.port in (7000-7009,7021)

Definitely! However -2 to -10 may also be a valid range for an "in"
operator. Should we then use ... instead of the hyphen?

I'm just struggling with the lemon parser and the way this should be
implemented. There are many options, though. One is to replace the
"in" with their replacing expressions *within* the lemon parser (this
would be the simplest), the other is to provide the logic within
Ethereal's display filter logic.

Regards,

Olivier