Ronnie Sahlberg wrote:
The reason is simple.
The field specifid is the field we want to perform the operation/calculation
on.
In order to be able to extract the value of that field from the packet
dissection engine, that value
must be part of the filter we use. Since otherwise the packet dissection
subsystem will
forget about the value before we can inspect it.
the reason we must add the field variable and make it part of the filter is
because no one has written
code yet to make that happen automatically in the background.
The time I slightly changed the layout of this dialog some days ago, I
was asking me the same question:
How do I have to use the filters?
As it's not obvious to use it, could someone do the changes you've outlined?
Regardless if it's changed or not, some tooltips would be nice to
explain the syntax for these fields in a few words and maybe give a
short example.
This would help a lot, IMHO.
----- Original Message -----
From: "Michael Tuexen"
Sent: Monday, March 08, 2004 4:03 AM
Subject: Re: [Ethereal-dev] IO Stat
I was using ethereal. I do not understand why I have
to provide two filters, one is a substring of the other.
Best regards
Michael
On Mar 7, 2004, at 12:28 AM, Richard Sharpe wrote:
On Thu, 26 Feb 2004, Ronnie Sahlberg wrote:
Use "tcp&&ip.len" as the filter and use "ip.len" as the field.
the field variable must be part of the filter string
Ummm, what exactly does that mean? Is this with Ethereal or Tethereal?
----- Original Message -----
From: "Michael Tuexen"
Sent: Thursday, February 26, 2004 2:37 AM
Subject: [Ethereal-dev] IO Stat
Dear all,
how do I use the IO stat advanced stuff to plot the sum of ip.len for
all
packets containing tcp. I tried to use tcp as a filter and ip.len as
the
field, but this does not work.
Thank you very much for your help.
