On Sat, Dec 30, 2000 at 03:41:16PM +0100, Guillaume Le Malet wrote:
> I think I'm going to work on:
> "The ability to delete packets in the packet list."
> Tell if you think it's a hard function to write.
The hardest part would, I suspect, be deciding what all the side-effects
of deleting a packet are.
If, for example, that packet was an RTSP packet that contained
information that said that a later TCP connection would have RTP traffic
on it, should deleting the packet in question cause Ethereal to forget
that the TCP connection in question should be dissected as RTP?
If the answer is "yes", then after the packet is deleted, Ethereal would
have to discard whatever state information it's built and re-scan the
remaining packets (as it does when, for example, a protocol property is
changed).
If the answer is "no", then any subsequent re-scan of the remaining
packets will nevertheless cause Ethereal to forget about the connection.
Now, if by
The ability to delete packets in the packet list.
the person who suggested that item really meant "the ability to arrange
that, when the capture file is saved, certain packets *not* be saved, so
that you can take a capture file, remove packets that contain
proprietary information and passwords and the like, and save it out so
that you can send that 'censored' capture to somebody else", you might
say that the answer should be "no", as *you* can still see those
packets...
...but you might also say that it should be "yes", as the recipient of
the "censored" capture won't see them.
My inclination would be to
1) have the answer be "yes", i.e. force a re-scan and a
redissection (as my third paragraph above suggests, there's
already code to do that);
2) support an "undelete" option.
On the other hand, if the only reason for deleting packets from the
packet list *is* to censor a capture file you'll be sending to other
people, there's now another way that could be done. You can currently
"mark" certain packets (with the "Edit->Mark Frame" menu item, or
control-M) and, when saving a capture, save only the marked packets.
You can also mark all frames and *unmark* selected frames, so you could,
for example, mark all frames, unmark those frames you don't want the
other person to see, and then do a "Save only marked packets".
