> Yes, but consider it in light of filter building - *click* *click* - and
> you're filter on ip, ip + port, etc - much handier.
Yes, but in your original mail you mentioned just highlighting, not
filter building. In Ethereal, if you "click on a portion of the frame",
it does "[highlight] that bit of the frame".
Ethereal has some ability to construct filters from fields in the packet
- if you select a line in the detail pane, "Display'Match Selected" will
construct and apply a filter that matches all frames where the given
octets in the frame have the same values that they do in the given frame
(the filter checks the octets at the same offset; it doesn't filter on
the "abstract" field).
As we don't currently have any way to construct filters from a GUI, we
obviously have no way to add filter entries by clicking on a field;
that's something to consider if we add a GUI filter-constructor.
> But it would be nice to rig a condition for start (possible with
> netxray) and limit it to 256k of traffic (also possible with netxray).
This isn't a capture buffer size, it's more of a "start trigger" and
"stop trigger"; "limit it to 256k of traffic" would just be a stop
trigger of "256k of traffic saved" rather than, say, "frame to port XXX
from host YYY".
> You can do this now with libpcap,
A program could use "libpcap"'s packet filter to implement stop triggers
(and start triggers, but you'd have to send packets up to userland and
do the start trigger stuff in userland; you'd need driver changes to
avoid the userland copy), but, unless the program does so, you can't do
start or stop triggers in the program - and Ethereal doesn't have start
or stop triggers for a capture.
