Ethereal-dev: Re: [ethereal-dev] Match Selected...
Gilbert Ramirez wrote:
>
> On Wed, 16 Aug 2000 13:26:05 John McDermott wrote:
> >
> > Laurent Deniel wrote:
> > >
> > > John McDermott wrote:
> > > >
> > > > > Making it work with the hex dump window would be nice.
> > > > >
> > > > So would if four bytes were selected, would it look at those four bytes
> > > > *anywhere* in a frame, or just at the same offset?
> > > >
> > >
> > > Just at the same offset. This is particularly useful for bytes in the
> > > undecoded data portion (you can not partially select in the protocol
> > > tree window).
> > I can see the use. The problem is that the data field may begin at
> > different offsets (due, for example to TCP or IP options) thus causing
> > one to miss some packets. This might confuse some users. For the case
> > of searching for data, maybe a search could be smart enough (in an ideal
> > world) to check at the offset from the data portion. This is possibly a
> > different search than searching the hex dump, though.
>
> Instead of frame[offset:length], the "match" function could produce something
> like tcp[offset:length] or even data[offset:length]
>
That would be the Right Thing to do (but AFAIK, we can not do that with
the current display filter yet ?)
--
Laurent DENIEL | E-mail: deniel@xxxxxxxxxxx
Paris, FRANCE | laurent.deniel@xxxxxxxxxxxxxxxxxxxxxxxxxxxx
| WWW : http://www.worldnet.fr/~deniel
All above opinions are personal, unless stated otherwise.
