Wireshark mailing list archives

The 'in' display filter operation


From: Jeffrey Smith <whydoubt () gmail com>
Date: Sat, 22 Aug 2015 22:11:06 -0500

I decided to try my hand implementing the 'in' operator.  I used the syntax
'x in {a,b,c}' (with commas).  In code I created a set type that contains a
GSList of stnode_t's.  At the gencode layer, I effectively generate an
OR-ed series of equality operations, but I cut out the redundant existence
operations.  The DFVM was untouched.

After doing this, I ran across doc/README.display_filter which proposes
various implementations for the 'in' operator.  Also, it mentions this
issue has been brought up at least as far back as 2004.  So what are the
current thoughts on this?  Any significant reason that no implementation
has made it in?

It would be trivial for me to change to the 'x in {a b c}' syntax (no
commas) if that is preferred.  However, I have not done any work toward
handling contiguous ranges and have no plans to at present.

 -- Thanks,
 -- Jeff Smith
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe

Current thread: