Wireshark · Ethereal-dev: [ethereal-dev] Changes checked in to let you save only currently displayed packets

[Guy Harris <gharris@xxxxxxxxxxxx>]

I checked in changes to add a "Save only packets currently being
displayed" check box to the "Save Capture File As" dialog box.

If that check box isn't selected, the entire capture file will be saved
(by moving or copying it, so the saved file will be in the same file
format as the original file - which means "libpcap" format, if it's a
live capture); this works as before.

If that check box *is* selected, only those packets that passed the
current display filter will be saved; the save file will be in "libpcap"
format.  This means that if a non-"libpcap" file was read in, and that
file couldn't be saved in "libpcap" format (because, for example, it
uses an encapsulation that isn't supported by "libpcap" format, or
because it has packets of more than one encapsulation type), you will
get an error if you try to save only the packets currently being
displayed.  (It could be changed so that if all the packets *currently
being displayed* are of a type that can be saved in a "libpcap" capture
file, it'll save them.)

Saving only the currently displayed packets doesn't count as saving the
capture, so, if the capture file is a temporary file from a live
capture, and you save the currently displayed packets (even if there is
no display filter in effect - we could disable the "Save only packets
currently being displayed" check box if there's no display filter in
effect - *or* if the current display filter happens to select all
packets):

	1) "Save" will still be enabled in the "File" menu;

	2) the temporary file will still be around, under that name, and
	   will, unless all of it is saved, be deleted if you close the
	   current capture (either with "File:Close", "File:Open", or
	   "Capture:Start") or if you exit.

If we add to Wiretap the ability to write capture formats other than
"libpcap" format, we could add a "file format" combo box to the "Save
Capture File As" dialog box, and let you write out either all the
packets, or the packets currently being displayed, in some format other
than the format the file is in or "libpcap" format.

I don't think I introduced any bugs wherein it gets confused about
whether the capture file is a temporary file, and removes it when it
exits - the code shouldn't do that (the only way to set the flag saying
the file is a temporary file is to pass in TRUE as the "is_tempfile"
argument to "open_cap_file()", and the only places where we pass in
anything other than FALSE are:

	the capture code, when reading in a temporary capture file (as
	opposed to a permanent capture file, i.e. a file from a capture
	where the user indicated, in the "Capture:Start" dialog box,
	that the capture should be saved to a particular file);

	"start_tail_cap_file()", which passes in the argument it was
	handed - and it's handed TRUE only if the capture file is
	temporary rather than permanent;

	the "File:Reload" code, if the file being reloaded is a
	temporary file;

and I tried it out and it didn't do that.