Wireshark · Ethereal-dev: Re: [Ethereal-dev] Saving all packets between the first and the last marked packet

[Guy Harris <guy@xxxxxxxxxxxx>]

On Dec 22, 2003, at 4:00 PM, Dick Gooris wrote:

> During investigation of real huge captured files, I missed the 
> functionality to be able to save a marked block of packets. So far 
> individual packets can be saved by marking them with Ctrl-M. I wrote 
> some code in three files : file.c, gtk/main.c  and gtk/file_dlg.c  to 
> add a check button in the 'Save As' window. With the help of this 
> feature you will get an extra check button saying 'Save between first 
> and last marked packet'.  If there are no markers at all, this check 
> button cannot be chosen like the 'Save only marked packets'. I 
> struggled a bit with the decision to make these two a radio type of 
> button. However, you need to be able to do not choose any of the radio 
> buttons at all. Though having markers, you may want to choose neither 
> 'Save only marked...' nor 'Save between first and last ...'.

The UI for saving packets will probably be revised at some point to 
match the one for printing packets; they should have the same ways for 
specifying which packets to print or save.

In the current CVS version, the options for printing are:

	selected packets only (which can only print one packet);

	marked packets only;

	all packets displayed (i.e., the ones that passed the current display 
filter);

	all packets captured (i.e., all the packets in the current capture 
file).

I think Ulf Lamping (who made the changes for printing packets) intends 
to put in support for packet ranges as well.

The options for saving are:

	all packets displayed ("Save only packets currently being displayed");

	marked packets only ("Save only marked packets");

	all packets captured (selecting neither of those).

It should be given the same options that printing is (including a range 
option if, as, and when that's added), and should show them in the same 
fashion - which is currently as a set of radio buttons ("Marked packets 
only" is disabled if there are no marked packets, and "All packets 
displayed" is disabled if there's no display filter, i.e. if "All 
packets displayed" would be the same as "All packets captured").

Your option is, in effect, a packet range, although it might be 
convenient to have it as a separate UI option.

Ranges do, however, raise a question - if you save a range, does it 
save *all* the packets in that range, or just the ones that are 
displayed?  Either answer is probably not always the right answer, so 
it might be that the range options (including "between first and last 
marked packet") should be separate from the other options - or, at 
least, from "all packets displayed" and "all packets captured".

Then again, would there be a use for "only displayed marked packets", 
saving only packets that are marked *and* displayed?