Guy Harris wrote:
>
> > Would this problem be smaller if the feature was only operational for
> > packets of the same type.
>
> I'm assuming here that by "packets of the same type" you mean "packets
> that, at the layer where the protocol-tree item is selected, are of the
> same type"; it wouldn't make it any easier to select a given protocol
> tree selection at, say, the IP layer to make it work only if the two
> packets are both TCP packets, say, and it wouldn't make it easier if the
> selection is at the TCP layer if both packets are HTTP packets.
Here's an idea: do a simple string match. I'd use this mostly for the
"Data" item in the tree, so store that string when I click on that item
in the tree. Then when I click the next packet (or hit the down arrow
or whatever) it searches for an item in the protocol tree with that
name; no match, no selection.
You could refine this with regular expressions in the future (e.g. so
you can match _similar_ fields in different types of packets) but that's
enough for my present needs.
> > if the new packet has exactly one instance of that field, we could
> > probably re-select it, but if it has more than one of them, which one
> > should it pick?
>
> Furthermore, if the line selected is assciated with a filterable field,
> and there's only one instance of that field in both packets' protocol
> trees, the problem is trivial - select the one-and-only entry
> corresponding to that field in the new packet's protocol tree.
I think you're trying for the "perfect" solution when "good enough" ...
is. Its present behavior is to just have nothing selected. If adding
this feature makes it misselect some times, that's no worse than having
nothing selected: the user has to select something else either way.
I envision this as a very quiet feature: some people won't even notice
that it's operating, but it will help those few of us who surf through a
protocol trace frequently.
--
= Warren Young, maintainer of the Winsock Programmer's FAQ at:
= http://www.cyberport.com/~tangent/programming/winsock/
=
= ICBM Address: 36.8274040 N, 108.0204086 W, alt. 1714m
