I suppose the difference here would be that you can't use the "contains" keyword with "opcode" to do partial string matches. But that's not nearly as useful with NFSv4 as with protocols with longer, more complex names and/or many similar names (with roughly the same purpose) - like SMBv1.
-Ian On Tue, Jul 6, 2010 at 6:43 PM, <[email protected]> wrote: > https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4975 > > --- Comment #6 from Guy Harris <[email protected]> 2010-07-06 01:43:27 PDT --- >> - Allow filtering of operations by name. >> - Now if I want to filter on all OPEN and CLOSE calls, I can set up the >> filter "nfs.opname==OPEN || nfs.opname==CLOSE", which means I don't have to >> memorize that OPEN is opnumber 18 and CLOSE is 4, or waste time looking them >> up. > > Or you can just do "nfs.opcode==OPEN || nfs.opcode==CLOSE", which works just > as > well. (Little-known fact: an integral field with a value_string can be > compared against the value names as strings. Other little-known fact; OPEN, > CLOSE, etc., even without quotes, are treated as strings in a filter > expression.) > > I've checked in a change to eliminate the opcode-as-string fields. ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <[email protected]> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:[email protected]?subject=unsubscribe
