Wireshark · Ethereal-dev: Re: [ethereal-dev] Should "Follow TCP Stream" filter the display or not?

[John McDermott <jjm@xxxxxxxxxx>]

There was a suggestion yesterday to be able to retrieve the display
filter so it could be used as a colorization filter.  I'm planning to do
that.  One option might be somehow make the filter used by the latest
follow-tcp-stream available so one could load a color filter and make
that stream, say, orange.  I think leaving it in effect is a good idea
since one can always clear it from the filter window with a few
backspaces and a return.  Maybe it is too much, but you could also put a
"clear display filter" button on the right side of the filter window
which would revert to the whole display.

Just my $.02.

--john


Guy Harris wrote:
> 
> It used to leave a display filter in effect, so only the packets in the
> TCP stream were displayed.  It now runs the display filter to generate
> the text window, and then undoes the display filter.
> 
> I'd used "Follow TCP Stream" in the past to select a particular TCP
> stream and look at its packets, so I actually prefer having it leave the
> display filter in effect, and would like to have *some* option to
> continue to do that, even if "Follow TCP Stream" doesn't do that.

-- 
John McDermott jjm@xxxxxxxxxx
Writer and Computer Consultant
J-K International, Ltd.
+1 505/377-6293 - V
+1 505/377-6313 - F