On Wed, Sep 18, 2002 at 10:31:48AM +0000, didier wrote:
> Guy Harris wrote:
> >
> > Currently, you can't. There is currently no mechanism in Ethereal to
> > support more than one conversation with the same endpoint addresses and
> > port numbers; such a mechanism would have to be added.
> Do we have a way to tell user other than 'col_add_fstr'.
You could put something into the protocol tree.
> > Such a mechanism would have to somehow arrange that more than one
> > conversation with the same endpoint addresses and port numbers exist,
> > and that the conversations be distinguished by something such as ranges
> > of frame numbers, so that a query searching for a conversation would
> > also take a frame number as an argument, and only a conversation whose
> > range of frame numbers includes that frame would be found. The frame
> > number argument would probably be the frame number of the frame being
> > dissected.
> >
> > In addition, the TCP dissector would have to "close" a conversation
> > either when it detects that a TCP connection has ended or that a new
> > connection has started.
> With relative_seq most of it is already there. Doesn't ethereal read the
> whole file sequentially at least once?
Yes, but you also have to be able to make sure you get the right answer
*after* the initial sequential pass through the capture - i.e., if you
click on some random frame, and the dissector for some protocol in that
frame looks for the conversation to which the frame belongs, it has to
find the *correct* conversation, regardless of which frames the user
clicked on before clicking on that frame.
