Wireshark-bugs: [Wireshark-bugs] [Bug 4905] VoIP Calls Prepare Filter unreliable
Date: Mon, 11 Oct 2010 05:18:53 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4905

--- Comment #17 from Alexandre Ferrieux <alexandre.ferrieux@xxxxxxxxxxxxxxxxxx> 2010-10-11 05:18:52 PDT ---
(In reply to comment #16)
> 
> Sure, users don't care, but we do :)

Indeed :) And I'm happy to take part in the reflexion if needed.

> > As a workaround, I'm currently adding _all_ incomplete fragments with "or":
> > better to have too many of them than missing important ones. It could be a
> > starting point until the API is extended...
> 
> ... and we could even limit that to fragments between the first and last frame
> of the call having the right protocol.

My 2 cents: this can even be refined to:

+ for each selected frame X with frag_offset>0:  || (ip.flags.mf ==1 && ip.id
== X.ip.id)

+ for each selected frame X with flags.mf==1:  || (ip.frag_offset>0 && ip.id ==
X.ip.id)

(Admittedly that gives a huge filter string pretty fast. Sigh.)

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.