Ethereal-dev: RE: [Ethereal-dev] Display filter as stop condition

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Eichert, Diana" <deicher@xxxxxxxxxx>
Date: Fri, 24 Oct 2003 13:36:32 -0600
What happen's if you set a stop filter and a capture filter?
Does it the packet endup getting parsed twice, which would 
take more CPU overhead?  Should other filtering be disabled 
when setting a stop trigger, or you just assume the user 
isn't going to shoot themselves in the foot?



-----Original Message-----
From: Gerald Combs [mailto:gerald@xxxxxxxxxxxx]
Sent: Friday, October 24, 2003 1:30 PM
To: sford@xxxxxxxxxxxxx
Cc: ethereal-dev@xxxxxxxxxxxx
Subject: Re: [Ethereal-dev] Display filter as stop condition


On Fri, 24 Oct 2003 sford@xxxxxxxxxxxxx wrote:

> I've added a "Halt" feature to tethereal that uses a display filter as
> a stop condition.  It is supplied as a string argument to "-H".  It
> can be very useful for troubleshooting to see what led up to a
> particular condition (kindof like setting a breakpoint with an
> emulator).  Combined with ring buffer, you can just start it, come
> back the next morning and have a good snapshot.

Cool!  Someone asked about this at a talk I was giving on Tethereal this
morning; they'll be happy to hear about this.

BTW, why did you add another flag (-H) instead of adding another autostop
condition to "-a", e.g. "-a filter:xxxxx"?


_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev