Ethereal-dev: Re: [Ethereal-dev] What is "File->Save Highlighted" menu item for?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Richard Sharpe <rsharpe@xxxxxxxxxxxxxxxxx>
Date: Mon, 8 Dec 2003 11:52:53 -0800 (PST)
On Mon, 8 Dec 2003, Guy Harris wrote:

> On Mon, Dec 08, 2003 at 10:31:38AM +0100, Ulf Lamping wrote:
> > Could someone explain to me, what the "File->Save Highlighted" menu
> > item is useful for? Please keep in mind, that this menu item is somewhat
> > very uncommon, and even worse, I don't have a clue, what it will really
> > do!
> 
> I'll let Richard Sharpe explain when it's useful.

It's useful for those cases where you are trying to understand portions of 
a packet or writing tools etc for other projects. 

There are many places where blobs are included in packets, and this 
feature allows you to extract a whole piece of a protocol to a file and 
run other tools over it.

The idea was suggested by Andrew Tridgell who wanted to be able to extract 
the NDR for DCE-RPC so he could run the tools he is developing in Samba 
over a bunch of NDR to see if he handles it correctly.

Since we have vague hopes of actually generating Ethereal dissectors from 
the NDR as well, this will form a useful facility for incrementally 
handling new RPC interfaces.

Regards
-----
Richard Sharpe, rsharpe[at]ns.aus.com, rsharpe[at]samba.org, 
sharpe[at]ethereal.com, http://www.richardsharpe.com