Ethereal-users: [Fwd: [ethereal-users] Following a TCP Stream]

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Ben Batten <bbatten@xxxxxxxxxxxxxxxxxxx>
Date: Wed, 01 Dec 1999 15:55:49 -0500
Ben Batten wrote:

> Warren Young wrote:
>
> > Darren Foo wrote:
> > >
> > >     After I follow a TCP Stream in the latest ver of ethereal, I can only see
> > > the packets between the 2 machines that I followed. How do I go back to show
> > > all the packets in the display screen?
> >
> > I'm pretty sure you can't.  Your best option is to save the capture
> > before you filter, then do the TCP follow.  Then if you want to do
> > something else, exit the program, load the saved capture file, and
> > continue working.
> >
> > Regarding the recent "reset display filters" thread: there needs to be a
> > way to reset _this_ display filter at least.  This is probably what I
> > was talking about when I said I had to restart the program to change the
> > filter, not a command line -R (-r?) filter.
> > --
> > = Warren Young: www.cyberport.com/~tangent |   Yesterday it worked.
> > = ICBM Address: 36.8274040N, 108.0204086W, | Today it is not working.
> > =               alt. 1714m                 |   Windows is like that.
>
> If I am following correctly, you cannot retrieve the original capture results en
> mass after you perform a "display" filter.  I believe one is able to retrieve the
> original capture by clearing the display filter dialogue and hitting enter (with
> the cursor present in the filter box).

(oops.  only replied to sender initiailly)