Ethereal-dev: Re: [Ethereal-dev] Saving all packets between the first and the last marked pack
Maybe. But I know some Ethereal users capture huge amounts of packets, in
order to spot specific (sometimes periodic) errors which require the
end-user to process this data over and over, to follow a TCP stram and then
mark all filtered frames etc, to obtain a list of marked frames where you
*think* the problem occurs. Maybe there are erratic packets in between the
marked ones, which are relevant too. In this specific situation, the "XXX
between first and last marked packet" option really makes sense.
I suppose I could be one of those users, though I've never really
thought about a need for "first and last marked packet" (I've always
wanted to simply mark a range or specific set, either before or after
applying a filter (such as following a stream)). Even in this case I
can fairly easily find the first and/or last marked frames
after-the-fact by "finding" frame.marked, though I understand that this
is a potentially somewhat slower solution. I'm just not sure that the
trade-off in UI complexity/intuitiveness is worth it. Like you said,
though, it's all a matter of personal opinion.
Of course, the continuing performance enhancements should make
reprocessing much faster anyway, yes? =)
Ian
