Ethereal-dev: Re: [Ethereal-dev] Stop capture trigger. RFC

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Dinesh G Dutt <ddutt@xxxxxxxxx>
Date: Wed, 25 Jun 2003 08:56:12 -0700
More thoughts:

Ronnie Sahlberg writes:
 > Hi list.
 > 
 > First of all, implementing a stop capture trigger as a filter string in the
 > display filter language
 > is probably not practical since this would require [t]ethereal to do a full
 > decode of the packet
 > in order to evaluate the trigger filter and thus would be slow.
 > It would probably not be practical or realistic for use with high speed
 > captures.
I agree. But can we not translate the display filters into capture filters
using eth[x:y] mechanism supported by BPF ? There maybe some fields that cannot
be thus supported due to conditional decisions on where the offset is, but if a
good majority can be supported, it would be a good first step. It also removes
the need for pursuing the two thread approach, I think.

Dinesh
-- 
Much unhappiness results from our inability to remember the nice things that
happen to us. - W. N. Rieger