Wireshark · Ethereal-dev: Re: [Ethereal-dev] Can I reuse ett_xxxx variables for an arbitrary number of subtrees?

[Lars Roland <Lars.Roland@xxxxxxx>]

Hello Kelly,

Kelly Byrd schrieb:

> But, I think it would be useful for users to be able to filter on
> daap.name == 'asal', but this would require that a reuse hf_daap_name
> when I'm recursing to the contained tags, rather than just add them
> as text labels. This is a similar question to my original ett_xxxx
> reuse question, can I reuse header filed statics?
Yes, you can do that. The most famous example for this is "ip.addr". It 
is used for both the IP source and destination.

There is only one thing to remember:
"ip.addr != 10.0.0.1" is equal to
"(ip.src != 10.0.0.1)||(ip.dst != 10.0.0.1)"

"!(ip.addr == 10.0.0.1)" is equal to
"!((ip.src == 10.0.0.1)||(ip.dst == 10.0.0.1))"

You see the difference.
So if you look for a packet without any field of daap.name equal to 
'asa1', you have to filter on "!(daap.name == asa1)". "daap.name != 
asa1" gives you any packet with at least one field of daap.name not 
equal to 'asa1'.

Best Regards,
Lars