Hi,
> Dissection is fine. What I was wondering is whether
it is possible to show these individual data chunks as separate frames
themselves.
>But they are in the same frame. I really prefer not to show them in a way they
have not been on the wire.
Basically agreed on the above point. Changing the default behavior may not be good due to all the copied lower layer bytes and resulting increase in the size of capture in case there are 4-5 chunks per packet. But still feel it would be a nice optional feature to have when doing actual offline analysis.
> Hence, when i apply display filter , only the chunks with exact matches should be visible. Is this supported currently?
>No. Filtering is based on packets. Not sure how to improve that. We can't show 'half' of a packet.
However, there might be ways to draw your attention to the upper layer packet which matches the
filter.
Regarding above point, would like to suggest that the packet information being displayed can be restricted to the PDU which actually matches the display filter. E.g out of an SCTP packet carrying 3-4 M3UA chunks, the pinfo of only the chunk matching the filter can be displayed?
Vineeth
On Fri, Jan 11, 2013 at 12:54 AM, Michael Tuexen
<Michael.Tuexen@xxxxxxxxxxxxxxxxx> wrote:
On Jan 10, 2013, at 5:31 PM, vineeth vijay wrote:
> Hi,
>
> Dissection is fine. What I was wondering is whether it is possible to show these individual data chunks as separate frames themselves.
But they are in the same frame. I really prefer not to show them in a way they
have not been on the wire.
> Hence, when i apply display filter , only the chunks with exact matches should be visible. Is this supported currently?
No. Filtering is based on packets. Not sure how to improve that. We can't show 'half' of a packet.
However, there might be ways to draw your attention to the upper layer packet which matches the
filter.
Best regards
Michael
