Index: doc/ethereal-filter.pod.template
===================================================================
RCS file: /cvsroot/ethereal/doc/ethereal-filter.pod.template,v
retrieving revision 1.3
diff -u -r1.3 ethereal-filter.pod.template
--- doc/ethereal-filter.pod.template	15 Oct 2003 02:13:32 -0000	1.3
+++ doc/ethereal-filter.pod.template	3 Dec 2003 11:30:15 -0000
@@ -25,11 +25,21 @@
 
 =head1 FILTER SYNTAX
 
+=head2 Check whether a field or protocol exists
+
 The simplest filter allows you to check for the existence of a protocol or
 field.  If you want to see all packets which contain the IPX protocol, the
 filter would be "ipx".  (Without the quotation marks) To see all packets
 that contain a Token-Ring RIF field, use "tr.rif".
 
+Think of a protocol or field in a filter as implicitly having the "contains"
+operator.
+
+Note: all protocol and field names are listed in the B<FILTER PROTOCOL
+REFERENCE> (see below).
+
+=head2 Comparison operators
+
 Fields can also be compared against values.  The comparison operators
 can be expressed either through C-like symbols, or through English-like
 abbreviations:
@@ -41,10 +51,31 @@
     ge, >=    Greater than or Equal to
     le, <=    Less than or Equal to
 
-An additional operator exists that is expressed only in English, not
-punctuation:
+=head2 Search and match operators
+
+Additional operators exist expressed only in English, not punctuation:
+
+	contains  Does the protocol, byte-string, or text string contain a value
+	matches   Does the text string match the given Perl regular expression
+
+The "contains" operator allows a filter to search for any sequence of
+characters that may occur in a protocol or field. To search for a given HTTP
+URL in a capture, the following filter can be used:
 
-    contains  Does the protocol, byte-string, or string contain a value
+	http contains "http://www.ethereal.com"
+
+The "matches" operator allows a filter to apply to a specified Perl-compatible
+regular expression (PCRE). Due to the nature of regular expressions, the
+"contains" operator is only implemented for fields with a text string
+representation. To search for a given WAP WSP User-Agent, one can write:
+
+	wsp.user_agent matches "(?i)cldc"
+
+This example shows an interesting PCRE feature: pattern match options have to
+be specified with the B<(?>optionB<)> construct. For instance, B<(?i)> performs
+a case-insensitive pattern match.
+
+=head2 Protocol field types
 
 Furthermore, each protocol field is typed. The types are:
 
@@ -56,7 +87,7 @@
     IPv4 address
     IPv6 address
     IPX network number
-    String (text)
+    Text string
     Double-precision floating point number
 
 An integer may be expressed in decimal, octal, or hexadecimal notation. 
@@ -146,6 +177,8 @@
 
 to look for \\SERVER\SHARE in "smb.path".
 
+=head2 The slice operator
+
 A slice operator also exists.  You can check the substring
 (byte-string) of any protocol or field.  For example, you can filter on
 the vendor portion of an ethernet address (the first three bytes) like
@@ -189,12 +222,14 @@
 
 	field[1,3-5,9:] == 01:03:04:05:09:0a:0b
 
+=head2 Logical expressions
+
 All the above tests can be combined together with logical expressions. 
 These too are expressable in C-like syntax or with English-like
 abbreviations:
 
     and, &&   Logical AND
-    or, ||    Logical OR
+    or,  ||   Logical OR
     not, !    Logical NOT
 
 Expressions can be grouped by parentheses as well.  The following are
@@ -262,6 +297,9 @@
 The B<ethereal-filters> manpage is part of the B<Ethereal> distribution.
 The latest version of B<Ethereal> can be found at
 B<http://www.ethereal.com>.
+
+Regular expressions in the "matches" operator are provided with B<libpcre>,
+the Perl-Compatible Regular Expressions library, see B<http://www.pcre.org/>.
 
 This manpage does not describe the capture filter syntax, which is
 different. See the tcpdump(8) manpage for a description of capture