Meant as an observation and not a work request, I notice that ethereal 0.8.8
still dies on both of the capture files I posted last month. Could someone
verify this? They are at http://research-cistw.saic.com/ethereal
Also, my comment on displaying followed streams and filtering perhaps wasn't
clear. I said:
> When selecting the follow tcp stream, a magic filter
> rule appears in the "filter window" and the display window pops up. May I
> suggest that the display window have its own "filter" window?
I would like to try and restate it and respond to Guy Harris:
> Note that the filter box is a combo box, and that the drop-down list
> should include all filters other than the ones inserted for "Follow TCP
> Stream", so that if the original filter rule isn't one generated by
> "Follow TCP Stream", it should be possible to put it back by selecting
> it from the drop-down list.
That's not what I'm asking. See pictures below.
> If the problem is that you don't want the display filtered when you do
> "Follow TCP Stream", then we need to have two operations on TCP streams,
> one of which collects the stream data into a "Follow TCP Stream" window
> but doesn't filter the display, and one that filters the display and
Yes, I don't want the display filter changed; but how about the two operations
being 1) "set filter to this packet's stream" (probably belongs in the Filter
menu), and 2) open a window showing this stream's contents, except that the
follow window would have it's own filter, as below.
Ok, there is the packet display window:
---------------------
|File Edit Capture ...
----------------------
| No.Time ...
--------------------
| 1 0.000000 ...
| 2 0.073882
| ...
-----------------------------------------------------
| | Filter | <filter rule here> | \/ |
-----------------------------------------------------
and the follow display window:
---------------------------
|login: uusseerrnnaammee
|password: ppaasswwoorrdd
|
|...
----------------------------------------------------------
| o Ascii o EBCDIC o Hex | save | print | close
----------------------------------------------------------
(ok so there isn't a save button, but look how good it looks)
My observation is that when I select a packet and follow it, a filter rule
like (ip.addr eq .... ) and (tcp.port eq ... ) appears in the filter rule
window, replacing what was there before. Why not give the display window it's
own filter window, like this:
---------------------------
|login: uusseerrnnaammee
|password: ppaasswwoorrdd
|
|...
-----------------------------------------------------
| | Filter | (ip.addr eq ... ) and | \/ |
-----------------------------------------------------
| o Ascii o EBCDIC o Hex
---------------------------------
That way the original packet display filter rule remains intact (since on a
large capture file it may take a while to reprocess the original filter rule).
If the prospect of having some joker putting in a filter rule that spans
multiple streams is too much of a nightmare (although it would be fun to use)
then how about not replacing the original filter rule, or at least creating
a *second* packet display window with the "follow" filter rule, and then the
third window which is the followed stream.
Thanks
Don
