John, Jaap,
Sorry for a delayed response, I was out of the office for a few days.
Thank you for you input. Right now I can not clearly see a simple generic solution to the issue and it seems nobody else needs it. It is relatively simple to implement the filtering functionality that I need as a separate application. The application would place the resulting filter string into Ethereal filter edit line automatically.
Thanks again for your input,
Alex
> -----Original Message-----
> From: ethereal-dev-bounces@xxxxxxxxxxxx
> [mailto:ethereal-dev-bounces@xxxxxxxxxxxx] On Behalf Of John McDermott
> Sent: Sunday, February 06, 2005 9:08 AM
> To: Ethereal development
> Subject: Re: [Ethereal-dev] FW: [Ethereal-users] GUI for filters
>
>
> On Sun, 6 Feb 2005 12:07:48 +0100 (CET), Jaap Keuter
> <jaap.keuter@xxxxxxxxx> wrote:
>
> > On Sat, 5 Feb 2005, John McDermott wrote:
>
> >> MYHOST ip.addr == 1.2.3.4
> >> SERVER ip.addr == 5.6.7.8
> >> WEB tcp.port == 80
> >>
> >> Then the filter selection window would show
> >>
> >> [] MYHOST ip.addr == 1.2.3.4
> >> [] SERVER ip.addr == 5.6.7.8
> >> [] WEB tcp.port == 80
> >>
> >> [] AND [] OR
> >>
> >> So selecting the first would show traffic to/from me, selecting all
> >> three
> >> with AND would show me httping to the server (or vice versa).
> >
> > Experience with another (non Ethenet-related) tool which
> sports such
> > an filter/sieve cascade tell's that it gets a bitch with
> more complex
> > expressions? Precedence rules of these multilevel filter
> expressions
> > can be tricky.
>
> Yes. I agree. I was explicitly not proposing this. The OP
> suggested
> checkboxes and I was proposing those. All my ASCII-art boxes
> [] were
> check boxes so one could only select individual filters, AND
> all selected
> or OR all selected. My thought was that more complex filters
> would use
> the current GUI.
> >
> > Is:
> > [ ] MYHOST_TX ip.src == 1.2.3.4
> > [ OR] MYHOST_RX ip.dst == 1.2.3.4
> > [AND] WEB tcp.port == 80
> >
> > the same as:
> >
> > [ ] MYHOST ip.addr == 1.2.3.4
> > [AND] WEB tcp.port == 80
> >
> > the same as:
> >
> > [ ] MYHOST ip.src == 1.2.3.4 || ip.dst == 1.2.3.4
> > [AND] WEB tcp.port == 80
> >
>
> I think this is way too complicated. There are GUIs for
> building complex
> filters, but really, I think that is overkill for Ethereal.
>
> --john
>
>
>
> --
> John McDermott, CCP
> Writer, Educator, Consultant
> jjm@xxxxxxxxxx www.jkintl.com
> V: +1 505/377-6293 F: +1 505/377-6313
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>
