Yes, but it would be very nice if this could be done from the packet
view, as well.
I love the conversation list feature. However, when I'm analyzing a
trace and deciding that I want to concentrate on a particular
"conversation" based on something I'm seeing while examining the packet
view, I shouldn't have to bring up the conversation list (and reprocess
the entire trace), find the conversation that I want a second time, and
THEN filter down. Conversation list is for a different mental "mode"
of analysis.
I often find it useful to select "Follow TCP stream" from the packet
list, it's a great shortcut when I'm trying to isolate a conversation.
Sometimes I need the text reassembly, usually with the protocols I
examine, I don't. Usually I just want the "conversation" isolation.
I've also been thinking that it would be extremely nice if we added a
right-click option when an IP address field (or another L2 or L3
address) is selected that allows us to quickly build an address filter
(i.e. with IP address, it will automatically build an ip.addr==A.B.C.D
display filter).
Ian
On Oct 11, 2003, at 7:41 AM, Ronnie Sahlberg wrote:
If you just want to filter for a specific UDP conversation then
ethereal can
already do this.
In ethereal, Tools/Statistics/Conversation List/UDP
click a conversation and select to filter using the popup menu
----- Original Message -----
From: "Kevin"
Sent: Saturday, October 11, 2003 11:46 AM
Subject: Re: [Ethereal-dev] Feature request - Follow UDP Stream
That is a lot more than what I was looking for. Just the simple
filtering is what I wanted, anything more is gravy.
_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev