Wireshark-dev: [Wireshark-dev] The 'in' display filter operation
From: Jeffrey Smith <[email protected]>
Date: Sat, 22 Aug 2015 22:11:06 -0500
I decided to try my hand implementing the 'in' operator.  I used the syntax 'x in {a,b,c}' (with commas).  In code I created a set type that contains a GSList of stnode_t's.  At the gencode layer, I effectively generate an OR-ed series of equality operations, but I cut out the redundant existence operations.  The DFVM was untouched.

After doing this, I ran across doc/README.display_filter which proposes various implementations for the 'in' operator.  Also, it mentions this issue has been brought up at least as far back as 2004.  So what are the current thoughts on this?  Any significant reason that no implementation has made it in?

It would be trivial for me to change to the 'x in {a b c}' syntax (no commas) if that is preferred.  However, I have not done any work toward handling contiguous ranges and have no plans to at present.

 -- Thanks,
 -- Jeff Smith