Ethereal-dev: Re: [ethereal-dev] Ability to save only packets selected by display filter?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Gilbert Ramirez <gram@xxxxxxxxxx>
Date: Fri, 19 Nov 1999 18:30:56 -0600
On Fri, Nov 19, 1999 at 03:53:53PM -0800, Guy Harris wrote:
> 
> Would changing the "Save" and "Save As" to write out the capture by
> reading through the capture file and writing out all or filtered
> packets, rather than to just move or copy the entire capture file, be a
> problem for anybody?

It should be easy enough to detect the easy case in which the user
wants to save all the packets (i.e., no display filter) of the temporary
capture file to a libpcap file, in which case we can copy/move. Otherwise
a packet-by-packet write is fine.

> Perhaps an *unfiltered* save should still change the name it has for the
> current file.  (For that matter, perhaps an unfiltered save, in the same
> file format as the input file, should continue to use the move/copy code
> path we use now, in which case disadvantage 2) goes away, and, if you

yep.

--gilbert