Ethereal-users: Re: [Ethereal-users] Filtering problems

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxxxxx>
Date: Wed, 10 Jan 2001 01:42:27 -0800
On Tue, Jan 09, 2001 at 03:27:08PM -0900, James A. Crippen wrote:
> May I suggest the following minor changes to the manpage Synopsis section
> for tethereal?  (Haven't looked at ethereal's page yet.)

It could use similar changes.

> Change
> 
>   ... [ -f filter expression ] ... [ -R filter expression ] ... [ filter
>   expression ]
> 
> to
> 
>   ... [ -f capture filter expression ] ... [ -R read filter expression ]
>   ... [ capture filter expression ]

...except that whether the last of those is a capture filter or a
display filter depends on whether you specified a "-r" flag or not, i.e.
whether you're doing a live capture or reading a capture file.

> which would make it more obvious that the default is a capture filter and
> not a read filter,

But that's the "default" only if no "-r" flag is specified; capturing
rather than reading a capture file is the default, but just calling the
command-line arguments "capture filter expression" might lead one to
believe that it's *always* a capture filter expression, which it isn't.

I've checked in changes to the Ethereal and Tethereal man pages, except
that

	1) I call the argument to "-R" a "display filter expression"
	   rather than a "read filter expression", as the document
	   refers to that type of filter as a display filter when it
	   discusses the syntax;

	2) it just says "filter expression" for the command-line filter
	   expression in Tethereal, as per the above.