Ethereal-dev: Re: [ethereal-dev] follow tcp stream alters which packets are displayed

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Mike Hall <mlh@xxxxxx>
Date: Mon, 15 Nov 1999 09:40:54 -0600 (EST)
On Sun, 14 Nov 1999, Nathan Neulinger wrote:

> If I have a filter set "yhoo", and then follow tcp stream for one of
> those packets, it shows a bunch of tcp ack packets that were not
> previously visible.
> 
> At the least, it might make sense to recalculate the display filter
> after follow tcp stream completes.
> 
> -- Nathan

One of the undocumented "features" for the follow tcp code is that the
tcpsteam you "followed" will become the new display filter. The filter is
very simple and just filters on the ip/port pairs in the connection.

Do we want to have the follow code reload the previous filter, or leave it
set on the new "follow" filter? My assumption was that if you did a follow
stream, you might only be interested in the packets associated with that
stream and therefore a display filter of just that stream is a good thing.
What do you guys think?

--Mike

+===================================================================+
| Mike Hall               Real programmers dream in Java.           |
| mlh@xxxxxx          Linux rules! Everything else just works.      |
+===================================================================+
|             finger mlh@xxxxxx for public PGP key                  |
+===================================================================+