Wireshark-dev: [Wireshark-dev] Conversation filters
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "Kukosa, Tomas" <tomas.kukosa@xxxxxxxxxxx>
Date: Wed, 21 Nov 2007 18:11:37 +0100
If I filter conversation from the context menu or the Conversations dialog it crates filter in following way (or similar):
ip.addr==ADDR1 and ip.addr=ADDR2 and tcp.port==PORT1 and tcp.port==PORT2
 
Unfortunaty it matches to two TCP streams ADDR1:PORT1<->ADDR2:PORT2 and ADDR1:PORT2<->ADDR2:PORT1
and if I have both of them in one file it is not easy to filter them from conversations menu.
 
Was it an intention or is it a bug?
 
If it is a bug what another filter style should we generate?
 
Regards,
  Tomas