Ethereal-dev: Re: [ethereal-dev] Match Selected...

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Gilbert Ramirez <gramirez@xxxxxxxxxx>
Date: Wed, 16 Aug 2000 13:39:25 -0500
On Wed, 16 Aug 2000 13:26:05 John McDermott wrote:
> 
> 
> 
> Laurent Deniel wrote:
> >
> > John McDermott wrote:
> > >
> > > >
> > > > Making it work with the hex dump window would be nice.
> > > >
> > > So would if four bytes were selected, would it look at those four bytes
> > > *anywhere* in a frame, or just at the same offset?
> > >
> >
> > Just at the same offset. This is particularly useful for bytes in the
> > undecoded data portion (you can not partially select in the protocol
> > tree window).
> I can see the use.  The problem is that the data field may begin at
> different offsets (due, for example to TCP or IP options) thus causing
> one to miss some packets.  This might confuse some users.  For the case
> of searching for data, maybe a search could be smart enough (in an ideal
> world) to check at the offset from the data portion.  This is possibly a
> different search than searching the hex dump, though.

Instead of frame[offset:length], the "match" function could produce something
like tcp[offset:length] or even data[offset:length]

--gilbert