I once implemented a quite usable prototype with similar idea, but more general.
You may be interested in it:
http://wiki.wireshark.org/Development/FastFiltering
(Oooh, I have not update the patch for a long time...)
On Wed, Nov 4, 2009 at 1:45 AM, Sake Blok
<sake@xxxxxxxxxx> wrote:
Would it also be "easily" possible with the new
packet list to freeze the displayed packets in a view. One could then have
multiple views in a dropdown list (with "whole file" as a default view). Then
the next display filter entered will work on the view, instead of the whole
file. That would be really reallu useful :-) But... I haven't digged into the
new packet list yet to know whether I'm now opening up cool posibilities or just
wishing for myracles ;-)
Cheers,
Sake
----- Original Message -----
Sent: Tuesday, November 03, 2009 5:48
PM
Subject: [Wireshark-dev] Optimization -
accumulative filters?
Hi,
Would it
bebeneficial to have a second filter option "box" in the main filter toolbar
that only filters on the displayed packets?
With the new packet list it may not be so difficult
to implement as it has a record of displayed packets and a new filter could be
applied
To only those packets.
Regards
Anders
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe
