On Feb 11, 2004, at 2:18 AM, Guy Harris wrote:
It might be that the number of token types should be reduced,
Or it might be that the rule for existence tests should allow an entity, rather than just a field, to be used, and that the semantics check phase should check whether an existence test is testing a field, rather than a string, an unparsed token, or a range.
I've checked in a change to do that; the filter expression "weebl" now reports
"weebl" is neither a field nor a protocol name.
rather than
Unexpected end of filter string.
The filter expression "eth[3:2]" reports
You cannot test whether a range is present.
rather than
Unexpected end of filter string.
but I think one could argue that it should report neither - instead, it should compile to a display filter that returns true if the "eth" field has at least 2 bytes starting at an offset of 3 and false otherwise. I.e., you're asking whether those bytes exist.
Does that make sense?
BTW, the filter expression
"what the heck
*without* a closing quote is considered syntactically legal, and the resulting filter doesn't appear to reject any packets. The phrase that comes to mind is, well, "what the heck?".
_______________________________________________ Ethereal-dev mailing list [EMAIL PROTECTED] http://www.ethereal.com/mailman/listinfo/ethereal-dev
