Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] Filter expressions for recursive structures

From: Richard Sharpe <realrichardsharpe@xxxxxxxxx>
Date: Fri, 29 Jul 2022 09:20:56 -0700
Hi folks,

The wonderful people working on 802.11 have started using recursive structures.

That is, they are embedding Info Elements (IEs) within Info Elements
and there can be multiple IEs of the same type within an IE within a
Beacon or Probe etc frame.

Now some people are asking to be able to refer to a specific embedded
IE within an IE.

That would seem to present problems because there is no way to
concatenate filter expressions.

About the best I can think of is pass some context to IE dissectors
via the pinfo field and to insert that into field values via a
proto_item_append_text ...

Are there any other thoughts about how to deal with this issue?

-- 
Regards,
Richard Sharpe
(何以解憂?唯有杜康。--曹操)(传说杜康是酒的发明者)