Wireshark-bugs: [Wireshark-bugs] [Bug 5279] "Save As" enhancement: Add ability to save all unmar
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5279
--- Comment #1 from Sake <sake@xxxxxxxxxx> 2010-10-06 09:06:19 PDT ---
Hi Chris,
> Also, it would be nice to be able to really toggle marked & unmarked packets.
> Currently when I tried the "Mark All Displayed Packets (toggle)" option, it
> didn't do what I thought it would. I thought it would toggle all the Marked
> packets as Unmarked and all the Unmarked packets as Marked, but it only
> Unmarked the Marked packets so that all packets were now Unmarked. Is that the
> intended behavior or is that a bug?
I would say the current behavior is the intended behavior. Otherwise there
would be no easy way to really unmark or mark all frames. While this is very
handy. Imagine the following scenario:
1) Use a display filter of "tcp.port==80"
2) Mark all frames
3) Change the display filter to "tcp.port==8080"
4) Mark all frames
What I would want is to have all the packets that have a tcp port 80 or 8080.
If it was really a toggle, then all traffic that had source port 8080 and
destination port 80 would be unmarked.
Of course this is a lousy example, cause I could have used a better filter to
start with. But I like the functionality of repeatedly displaying stuff and
adding it to the marked list without having to worry about some frames being
unmarked in the process.
There is a nice way of doing what you want already. After marking all the
frames you *don't* want, use the display filter "frame.marked==0", then go to
"Save as..." and write all displayed packets to file.
Does that suit your need? I'm a bit hesitant about adding a lot of options to
the "Save as...". I can see the request for "Save undisplayed packets" coming
too ;-)
Cheers, Sake
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
