Wireshark · Ethereal-dev: Re: [ethereal-dev] follow tcp stream alters which packets are displayed

[Nathan Neulinger <nneul@xxxxxxx>]

Gilbert Ramirez wrote:
> 
> On Sun, Nov 14, 1999 at 05:53:22PM -0600, Nathan Neulinger wrote:
> > Guy Harris wrote:
> > >
> > > Yes, that's intentional - it changes the display filter to something
> > > that matches all packets in the stream, and no other packets, so that
> > > you can use it to limit the display to packets in a TCP connection.
> >
> > Might be good then to actually change the display filter specification
> > in the filter box. Right now, it's non-intuitive cause the filter box
> > still says "yhoo", but the displayed packets don't necessarily match
> > that specification.
> >
> > -- Nathan
> 
> I tried something similar a while back:
> 
> http://ethereal.zing.org/lists/ethereal-dev/199908/msg00188.html
> 
> However, there were some reservations, so I reverted my change.
> Some people like having the filter stay in effect, and others don't.
> Hmm, sounds like a good user-defined behavior to me.

How about something like this - add a icon or something next to the
display filter that would indicate if the filter matches the current
display. i.e. as soon as you start to type something into the filter
box, the icon would indicate "non matching", when you hit enter it would
indicate matching, when you did a follow tcp stream it would revert to
non-matching. 

Or a change in colors, or something along those lines.

-- Nathan

------------------------------------------------------------
Nathan Neulinger                       EMail:  nneul@xxxxxxx
University of Missouri - Rolla         Phone: (573) 341-4841
Computing Services                       Fax: (573) 341-4216