From Sake Blok:

wireshark SHOULD be able to filter on multiple hf's with the
same field-name, BUT there is a little bug in the code. I have pinpointed it to
the following in epan/dfilter/dfvm.c:
...
It actually loops through all the hf's with the same name, but only checks
against the original (first) hf.


svn path=/trunk/; revision=21372

epan/dfilter/dfvm.c

@@ -414,7 +414,7 @@ dfvm_apply(dfilter_t *df, proto_tree *tree)
 				hfinfo = arg1->value.hfinfo;
 				while(hfinfo) {
 					accum = proto_check_for_protocol_or_field(tree,
-							arg1->value.hfinfo->id);
+							hfinfo->id);
 					if (accum) {
 						break;
 					}