Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] bug 2794

Date: Tue, 8 May 2012 09:11:52 -0400 (EDT)
I'd like to get back to working on bug 2794 (Questionable display filter fields) and hopefully have it ready for the 1.8 release.  I realize its a lot of "brute force" work of search/replace but I will gladly volunteer in the name of consistency.  I feel the script (checkfiltername.pl) was a tourniquet to stop the bleeding, but there is still the issue of all of the lost blood.  However the biggest stumbling block I ran into was no "official" display filter field format.  I don't feel I'm in a position to create an "official" format, but I would gladly work something into the field checking script.  The bug lists a few of the "big offenders" (from my interpretation of the "desired" format), mostly deriving from protocols/dissectors that are "grouped" or have subdissectors with a common prefix where the '.' (periods) don't line up as expected.
 
Is this worthy of a Sharkfest (sub)topic?  I won't be attending but thought this topic may be better suited for in person meetings rather than a long back and forth email conversation.
 
There are also a few outstanding patches in the bug for some of the straightforward 'questionable' display filters, if someone would be so kind as to review and check them in.  Hopefully they still merge cleanly (due to age) but it should be easy to decipher as it was just search/replace of filter fields.
 
Mike