Ethereal-dev: Re: [ethereal-dev] follow tcp stream alters which packets are displayed
> One of the undocumented "features" for the follow tcp code is that the
> tcpsteam you "followed" will become the new display filter.
It's actually documented, at least in part:
Tools:Follow TCP Stream
If you have a TCP packet selected, it will display the
contents of the data stream for the TCP connection to
which that packet belongs, as text, in a separate
window, and will leave the list of packets in a filtered
state, with only those packets that are part of that TCP
connection being displayed. You can revert to your old
view by pressing ENTER in the display filter text box,
thereby invoking your old display filter (or resetting
it back to no display filter).
> Do we want to have the follow code reload the previous filter, or leave it
> set on the new "follow" filter?
At least if the previous filter was empty, I *definitely* do *not* want
the follow code to reload the previous filter. I primarily use "Follow
TCP Stream" to get the display limited to all packets in a given TCP
connection; I usually just dismiss the text window as soon as it
completes.
I wonder whether there are, in fact, two *different* operations that
people want to perform on a TCP stream:
1) limit the display to the packets in the TCP stream;
2) put the payload from the stream, as text, into a window.
I use 1), and don't care about the payload from the stream showing up in
a window. It sounds as if at least some of the people who do 2) don't
care about having the display filter changed to show all packets in the
stream and no packets not in the stream.
Perhaps we should have those as separate operations, with 1) not popping
up the window, and 2) not changing the display filter?
