On Tue, Aug 06, 2002 at 06:00:12PM -0400, Khachaturov Vassilii wrote:
> > I am unhappy about this. It only works if everybody does
> > "inner++" instead of "inner=TRUE". The latter is the more
> > sensible thing to do for a boolean value.
>
> I am definitely an ethereal newbie, but my impression was that
> a dissector never specifically assigns any booleans like that.
> Instead, the moment when a protocol dissector is called,
> it's "protoname" filter automatically triggers.
>
> Same thing seems to happen when an FT_NONE is added -
> the filter (named as described) in the associated hf registration info -
> is triggered.
The "protoname" fields aren't Booleans. A Boolean is a field of type
FT_BOOLEAN, and they really *are* specifically assigned.
A filter expression that tests a Boolean compares it with 1 or 0, e.g.
ip.tos.delay == 1
A filter expression that gives a field name, but no comparison operator,
is testing for the presence or absence of that field, not whether it's
"true" or "false". That type of filter expression works for *all* types
of fields, but only tests whether the field is present or absent, it
doesn't test the value of a field.
