Ethereal-users: Re: [Ethereal-users] Three big problems

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Mon, 4 Nov 2002 23:31:51 -0800
On Tue, Nov 05, 2002 at 06:31:54PM +1100, Ronnie Sahlberg wrote:
> But that only applies if you do not use any capture filters, right?

It applies if you do not use any *read* filters.

> If you use capture filters (display filter form) in order to minimize the
> amount
> of captured data, [t]ethereal will do a complete dissection of every packet
> and thus state information will
> build up?

It will do that if you use read filters (which are supported, for packet
capture, only by Tethereal at present, not by Ethereal); I use "capture
filters" only to refer to tcpdump-style capture filters, which are
stateless.