Ethereal Usability Enhancements

["Ulf Lamping" <ulf.lamping@xxxxxx>]

Hi List!

I have updated the doc I send on tuesday, changed the things discussed in the list.

So I have a reference for the menu changes to start with, when the next release will be out.

Regards, ULFL

______________________________________________________________________________
Horoskop, Comics, VIPs, Wetter, Sport und Lotto im WEB.DE Screensaver1.2
Kostenlos downloaden: http://screensaver.web.de/?mc=021110

Ethereal Usability Enhancements

This is a document collecting some things where Ethereal lacks
usability. I know, that most of the topics are grown for a long time
now, and no one found the time to fix it.

This proposal is maybe not the ultimate solution, but I hope a step in
the right
direction, which will need a moderate effort to be implemented. All the
topics in this document are not "carved out of stone", feel free to
send me comments about the things described here. But please don't
suggest new features, as we should fix these usability things first,
before adding new features (as I can also imagine a lot of new features
too, not mentioned here).

Author: Ulf Lamping@xxxxxx
Date: 2003.10.23

1. Ethereal Usability Enhancements
   1. Main Menu
      1. Menu in Current CVS
      2. Usability enhanced
   2. Packet vs. Frame
   3. "Decode As" / "User Specified Decode" dialogs
   4. "Print" dialog
   5. Capture vs. Display Filters
   6. Save data/settings at Program Quit
      1. Capture file
      2. Preferences file

---

Main Menu

I have tried to improve the menu structure, to be more like common
applications and a bit more consistent to the user.

After comparing the current Ethereal menu implementation with the way
it could be, and have a deep look into the "human interface guidelines"
of Gnome and KDE, I would suggest the following new menu structure.

Menu in Current CVS

Just for reference, this is the menu as it currently is checked in CVS.

File	Edit	Capture	Display	Tools	Help
Open...	Find Frame...	Start...	Options...	Plugins...	Help
Close	Find Next		Match >	Follow TCP Stream	About Ethereal...
Save	Fine Previous		Prepare >	Decode As...
Save As...	Go To Frame...		Colorize Display...	Go To Corresponding Frame
Reload	----------------------		Colapse All	TCP Stream Analysis >
----------------------	Time Reference >		Expand All	Summary
Print...	Mark Frame		Show Packet In New Window	Protocol Hierarchy Statistics
----------------------	Mark All Frames		User Specified Decodes...	Statistics >
Print Packet	Unmark All Frames
----------------------	----------------------
Quit	Preferences...
	Capture Filters...
	Display Filters...
	Protocols...

Usability enhanced

This is my suggestion, how the menu could look like, to be a lot more
common to a normal user.

To get an idea, where to put each menu item in future:

• File: Input- / Output ...
• Edit: Search&Mark Frames / Edit Preferences
• View: Manipulate the behaviour of the output window
  
• Capture: Live capture of network data (includes filtering)
  
• Analyse: Captured data analysis (coloring, filtering, ...)
  
• Statistics: Various statistics of the captured data
• Tools: Internal and external tools
• Help: Give the user a helping hand
  

File	Edit	View	Capture	Analyse	Statistics	Tools	Help
Open...	Find Frame...	Show >	Start...	Coloring Rules...	Summary	Plugins	Contents...
Open Recent >	Find Next...	Time Display Format >	Stop (not Win32)	Display Filters...	Protocol Hierarchy		About Ethereal...
Close	Find Previous...	Name Resolution >	Capture Filters...	Match >	Conversation List >
--------------------	--------------------	Options		Prepare >	Service Response Time >
Save	Go To Frame...	--------------------		--------------------	Watch Protocol >
Save As...	Go To Corresponding Frame	Collapse All		Decode As...	IO >
--------------------	--------------------	Expand All		User Specified Decodes...	ONC-RPC >
Page Setup	Time Reference >	--------------------		Enabled Protocols...	RTP-Analysis >
Print Preview...	--------------------	Show Frame In New Window		--------------------
Print...	Mark Frame	Reload		Follow TCP Stream
Print Packet	Mark All Frames			TCP Stream Analysis >
--------------------	Unmark All Frames
Quit	--------------------
	Preferences

Hints:

• The Italics items have to be newly implemented, the Strikethrough items have to be removed, compared to the current implementation.
• View/Refresh was former File/Reload
  

The three submenus below "View" will have the following items:

Show (checkitems)	Time Display Format (radiobuttons)	Name Resolution (checkitems)
Main Toolbar	Time of day	Enable MAC
Filter Toolbar	Date and time of day	Enable Network
Status Bar	Seconds since beginning of capture	Enable Transport
Packet List	Seconds since previous capture
Packet Dissection
Packet Data

Things left to think about:

1. Which menu items to put in "Analyse" and which in "Statistics"?
2. What about the "Decode As..." and "User Specified Decode" thing? I'm still confused.
   
3. Put "Tools/Plugins" into "Help/About Plugins" and remove "Tools" completely? Drawback: If we will get new items for "Tools" in the future, we have to add it back into the menu again.
   

Packet vs. Frame

All over the GUI, both words are used, IMHO with the same meaning.
Unless there is a good reason not to, we should use only one of 
these words, and this consistent in the entire GUI (in all menus,
dialogs, ...). IMHO, I would prefer to use "Packet" everywhere, and
rename every appearance of  "Frame".

This has nothing to do with the naming scheme of the specific
protocols, it's only about the generic GUI elements like the menu
itemnames itself: e.g."View/Frame In New Window", "Edit/Find Frame" and
also the corresponding dialogs, like some labels in the dialogs of:
"Tools/Summary", "Capture/Start".

"Decode As" / "User Specified Decode" dialogs

There shouldn't be two menu items to trigger almost the same
functionality. This is very confusing for a normal user.
One solution could be to build something similar to the colorize
display dialog. You will see an overview of the current filters when
triggering this dialog by menu or toolbar. From there, you can push
some buttons to add/remove rules to the current decodes and such.

"Print" dialog

Currently, the user can print the current frame (without any Ethereal
specific dialogbox), or all (marked) frames in the capture file. This
is confusing when using the toolbar icon, as you don't know what will
be done before pressing the icon.

IMHO it s better to build a dialog, where the user selects which frames
he/she would like to print (using radio buttons):

• All Frame(s)
• Current Frame
• Frame(s) from xxx to yyy
• Marked Frame(s)

ToDo:

1. Group the items in the dialog using frames
2. Add a Label to the dialog: "number of frames" / "number of pages" to be printed

The common menuitems "Page Setup" and "Print Preview" should be
implemented. As the support for this isn't very good in GTK, a lot of
effort had to be done for this. Left to be done in the future.

Capture vs. Display Filters

One of the biggest issues to solve in a usability perspective is the
"differences" in capture and display filters. It is really odd for new
users to learn two different filter "languages". For example: The
online help on capture filters is telling you: "see manual page of
tcpdump", which is difficult on a usual win32 machine :-(.

A "better than nothing" solution (and
quick to implement) would be to include the text from the
user's guide into the online help fields, for the capture and display
filters.

But of course, the clean solution would be to have just one filter
language, presumably the display filter syntax, and derive capture
filters from it. The Win32 specific Ethereal GUI "Packetyzer" http://www.packetyzer.com seems
to be doing just that. We could have a look, how they solved this topic.

I will add some additional help text to the online help, explaining the
syntax of Display and Capture Filters.

Save data/settings at Program Quit

When Closing Ethereal, all things not saved are simply discarded. Your
unsaved capture file and all unsaved settings are gone. This is not the
way it should be.

Capture file

For an unsaved capture file, a dialog should come up:

Caption: "Ethereal: Capture data unsaved"
Icon: "QUESTIONMARK"
Text: "Would you like to save your capture data?"
Buttons: "Yes / No / Cancel"

• Yes: Open "Save As" dialog
• No: Simply quit Ethereal (resp. continue with next "unsaved dialog")
  
• Cancel: continue using Ethereal

This dialog should also come up, if the user would loose the file
content otherwise, e.g. at "File/Close" and "Capture/Start".

If the user pushes the "Yes" button and cancels the "Save As" dialog
afterwards, simply return to this dialog!

Preferences file

For an unsaved preference file, a dialog should come up:

Caption: "Ethereal: Preferences settings unsaved"
Icon: "QUESTIONMARK"
Text: "Would you like to save your preferences settings?"
Buttons: "Yes / No / Cancel"

• Yes: Save settings into "Preferences" file
• No: Simply quit Ethereal (resp. continue with next "unsaved dialog")
  
• Cancel: continue using Ethereal
  

For "Capture Filters", "Display Filters" and "Color Filters", something
similar to the Preferences file should be done.