ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: [Wireshark-users] Is there some reason why the list in the "in" operator in pack

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 17 Oct 2018 12:35:34 -0700
In

	https://ask.wireshark.org/question/5530/what-is-the-expected-valueformat-for-display-filter-in/

somebody asks why

	tcp.stream in {1,8,12,18}

doesn't work.

The answer is "you have to separate them with spaces".

Is there some reason why they *must* be separated by spaces, rather than by allowing, for example, commas or semicolons?

One reason that comes to mind, for floating-point numbers, is that, if we use the locale's decimal separator in filter expressions, a comma might be the decimal separator, i.e.

	float.field in {1 <one and a half> 2}

would be

	float.field in {1 1.5 2}

in some locales but

	float.field in {1 1,5 2}

so, while

	float.field in {1,1.5,2}

would work in locales with . as a decimal separator,

	float.field in {1,1,5,2}

wouldn't work in locales with , as a decimal separator.

Is that the reason?