Ethereal-dev: Re: [Ethereal-dev] tethereal

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Sat, 22 Dec 2001 13:59:42 -0800
On Fri, Dec 21, 2001 at 09:00:00PM +0100, Michael Tuexen wrote:
> thanks for fixing it. I'm wondering if it is possible to
> introduce another stop condition for capturing:
> Stop the capture if you have captured a packet which matches
> a given (display)-filter.

The "stop the capture" part is possible.

The display filter part would mean that you'd have to build the protocol
tree for each packet as they're captured; this is also possible (it's
similar to what happens with a read filter), although it might be
expensive (use significant amounts of CPU time).

It could also be done with a capture filter (which would be less
expensive).