Wireshark · Ethereal-dev: [ethereal-dev] Where are the filtered packets kept?

[Aaron Hillegass <aaron@xxxxxxxxxxxx>]

I'm new to this,  so I hope these aren't really dumb questions.

I'm building a screen to show a summary of information of the displayed
packets.  Total bytes, for example.  And I'd like to iterate through the
filtered packets,  not all the ones in the capture file.  Here is the
highlights of my first try:

void tally_frame_data(gpointer f, gpointer st) {
  summary_tally * sum_tally = (summary_tally *)st;
  frame_data *cur_frame = (frame_data *)f;
  sum_tally->bytes += cur_frame->pkt_len;
  sum_tally->count++;
}
...
  st = (summary_tally *)g_malloc(sizeof(summary_tally));
  st->bytes = 0;
  st->count = 0;
  g_list_foreach(cf.plist, (GFunc)tally_frame_data, st);
  printf("\n***** count = %i\n", st->count);

The file read in has 344 packets.  The filtered set has 112 packets.  My
count is 345.  I get the same results if I use cf.plist_first.

Two questions:
   Why isn't it 344? (The contexts of the entire file)
   Where can I get the list of filtered packets? (Which would have a
count of 112.)

Thanks a bunch,
Aaron Hillegass
aaron@xxxxxxxxxxxx