Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 2794] Questionable display filter fields

Date: Wed, 13 Apr 2011 08:59:26 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2794

--- Comment #9 from Stephen Fisher <steve@xxxxxxxxxxxxxxxxxx> 2011-04-13 09:59:25 MDT ---
(In reply to comment #3)
> I wrote a perl script

Thanks for writing it in Perl - some of us "old timers" never bothered to learn
Python ;)

> I was also unclear of the offical rules for when to use periods in a filter. 
> Once the PROTOABBREV is met and a period followed, there was a lot of
> inconsistency as to when they were applied.

I've often struggled with this decision too.  I will generally do this after
the protoname and first dot: Whenever there will be more than one "subtype"
it's separated by periods, for example (from packet-wow.c):

  wow.srp.m1
  wow.srp.m2
  wow.srp.g_len

Otherwise, I use underscores:

  wow.realm_socket
  wow.realm_name
  wow.realm_color

There are no rules about this as Chris stated.  Perhaps there should be at
least some guidance in the developer's documentation.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.