> Or, as an alternative, we could handle expressions that do an equality > comparison on certain fields specially - have a "proto.c" routine that > can check whether a dfilter expression checks if a particular field > (specified by its name, or by its index) is equal to a constant and, if > so, returns the constant, and, if the expression is, say "tcp.port == > 666", we could just have TCP check for that port number (by checking in > a list, or looking it up in a hash table, or...). It should also treat expressions that just do an OR of multiple such simple comparisons of the field in question against a constant specially - you'd add all the constants to the list of ports.
Powered by MHonArc 2.6.10