Jasoh House wrote:
> I think that surprising a person with a not-entirely-sensible graph is
>not quite the right way to do it. The user should have some idea that
>things might not be entirely correct.
> What about adding something like [delta t < 0] to COL_INFO? That
>would give some indication to the user that something
>not-entirely-sensible is going on to begin with. That would help excuse
>other tools (such as io-stat) for not working 100% in such a scenario.
>Of course, the tools should strive to work the best way they know how
>(and at the very least not hang)... but some kind of advanced warning is
>always good.
>
Yes, I think that a [time_delta < 0] indication seems to be a good idea.
Maybe it would be also good to add some warning in TCP stream analysis and similar analysis functions that are
depending on the time stamp information.
There were some discussion about having some default color filters that flags for incorrect checksum and similar.
I tried to prepare a color filter for negative frame.time_delta.
I thought that it would be possible to use a filter like
frame.time_delta < 0
or
!(frame.time_delta >= 0)
but I don't get it to work (Ethereal 0.9.8, Windows 2000/98).
I can filter out packets where frame.time_delta >= 0, but not the opposite.
Regards,
Martin
