Wireshark-dev: Re: [Wireshark-dev] Display filter count?
From: Guy Harris <[email protected]>
Date: Mon, 20 Nov 2006 16:40:52 -0800
Maynard, Chris wrote:
Is there a way to get the count of the number of times a display filter
is true?  We have protocols that encapsulate multiple higher layer
protocols such that the number of packets left displayed after the
display filter is run does not necessarily correspond to the number of
matches to that filter.  It is not that important how many packets are
displayed, but how many matches there are.
The filter code acts on each packet in the packet list, and either 
matches or doesn't match; it doesn't know anything about a packet at one 
level containing multiple packets at another level, so it has no concept 
of there being more than one match for a packet.