Wireshark-dev: Re: [Wireshark-dev] Filtering using DHCP and SSDP throws error
From: Joerg Mayer <[email protected]>
Date: Thu, 29 Nov 2007 19:30:19 +0100
On Thu, Nov 29, 2007 at 07:43:52AM -0800, Gerald Combs wrote:
> > Use "bootp".   DHCP is (more or less) a superset of BOOTP.  
> > The parsing of the dhcp components is done within the bootp 
> > dissector.  

Or to be more precise: bootp.dhcp
> Should we change the instances of "bootp" in the BOOTP/DHCP dissector to 
> "dhcp"? This isn't the first time this has confused someone.

The protocol is bootp and dhcp is just a special case of it.
So renaming it is a rather bad idea.
If you see this as a serious issue than add a hack for this
into the filter code by replacing ^dhcp by boot.dhcp
Maybe allow a dissector to register aliases that are allowed
to be used in filters? Like ip.version for ipv6.version or
tacacsplus for tacplus?
If that idea sound acceptable: Once the filter gets applied, it should
be replaced by the "correct" value in the display filter gui.


Joerg Mayer                                           <[email protected]>
We are stuck with technology when what we really want is just stuff that
works. Some say that should read Microsoft instead of technology.