> While we are discussing confusing UI:
> I find the display filter field on the main window misleading. When I
> first tried Ethereal, I typed a filter into the textfield, and hit
> enter. I expected the filter to be applied to the displayed data. After
> some experimentation, I realized that the filter is only used when the
> file is reloaded.
>
> I think there should be an "apply filter" button (either on the main
> window or the filter window) that will reload the data with the filter
> activated. Or, the filter should be applied when the user hits enter
> in the display filter textfield.
>
> Comments?
Sounds good.
At some point I'll probably change the way the display filtering works,
so that, instead of filtering by re-reading the capture file and reading
only packets that match the filter, it just scans the packets we read in
initially to see if they match the filter, and marks the ones that do to
be displayed (assuming Gilbert doesn't beat me to it, given that the
display filtering changes he's working on will probably work in the same
fashion). The change you suggest should fall out of that without too
much effort.
It should also mean that we can use the BPF interpreter in "libpcap"
(until Gilbert finishes his stuff) rather than the current limited
filtering code in "wiretap", which would, I think, mean there'd no
longer be any reason to use "libpcap" to read capture files - it'd be
used only for live captures (and to supply the userland BPF
interpreter). Given that, we could probably nuke the "--with-wiretap"
configuration option, and *always* use "wiretap" to read capture files.
