Cox, Roger wrote:
- A 'follow http conversation' feature. That is, depending upon the
connection persistence settings, the http session could be a single TCP
conversation, or it could be broken up into a zillion little snippets. I
would love to be able to display the whole sequence at once. I'm imagining
just combining all TCP conversations from a single source ip address to one
server's port 80. Such a feature might combine http conversations that are
logically distinct (and worse, interleave them in ugly ways), but for most
of the cases I encounter it would be a great help.
I can see this being useful, too. Given your description, I would think
it would be easy to do a filter for that. You'd then have to add an
option to the "follow TCP stream" code to update the window as new data
come in. This would be a valuable feature (for me at least) in and of
itself.
- Real-time display. In addition to having this feature on a captured
trace file, I'd like to be able to display the conversation on the fly. As
it was, I had to co-ordinate with the clients at the interop, and get them
to stop while I saved and re-started traces. It would be nice to have a
continuous capture/disply feature.
I'm not sure what you mean. Do you want to watch the "follow TCP stream"
in real time?
- Automatic triggering, by client. Sometimes multiple clients were testing
against the server at the same time. It would have been nice to have the
http conversation windows open automatically when new clients connected.
I would very much like to add some triggers to Ethereal. In addition to
your trigger I'd like to see:
- Capture start trigger
- Capture stop trigger
and perhaps others.
If the answers so far are no, is ethereal a reasonable base from which to
develop such things, or is there code in it (or elsewhere) that could serve
as a starting point?
These would be welcome additions to ethereal, IMHO. (I could use start
and stop triggers in a course I'm teaching next week.) I would
encourage you to start work on these
--john
--
John McDermott
Writer, Educator, Consultant
jjm@xxxxxxxxxx
http://www.jkintl.com
V +1 505/377-6293 F +1 505/377-6313
