Description:
This method returns TRUE if the table data matches the parameter "Value to match". A typical use of this method is to distinguish various classes of message, for example commands, responses and data.
Parameters:
|
[Required] |
Table |
"Which table" |
|
[Required] |
Field |
"Which field" |
|
[Required] |
Int64 |
"Value to match" |
Example:
Examples of its use can be seen in the HTTP and SMTP decoders. One instance from the latter decoder is (the table has been edited for clarity):
TABLE cmd_reply
{0x48454c4f "HELO" "Hello" 1 hi}
{0x4d41949c "MAIL" "Mail" 1 from}
{0x51554954 "QUIT" "Quit" 1 end}
{0x32313120 "Status" System status, or system help reply" 2}
{0x32313420 "Help" "Help message" 2}
{Default ""default"3}
ENDTABLE
FIELD type (Fixed 4) (Hex) SUPPRESS_DETAIL NO_MOVE
Group cmd IF (MatchTableData cmd_reply type 1)
This takes the value in the field "type" and looks it up in the table "cmd_reply". Then the table data for that entry is checked against the constant given in the parameter "Value to match". For example if the value of "type" were 0x48454c4f. the test would return true because this value matched the "HELO" entry in the table, and the table data for "HELO" is 1, which matches the 1 given as the parameter.