What happen's if you set a stop filter and a capture filter?
Does it the packet endup getting parsed twice, which would
take more CPU overhead? Should other filtering be disabled
when setting a stop trigger, or you just assume the user
isn't going to shoot themselves in the foot?
-----Original Message-----
From: Gerald Combs [mailto:gerald@xxxxxxxxxxxx]
Sent: Friday, October 24, 2003 1:30 PM
To: sford@xxxxxxxxxxxxx
Cc: ethereal-dev@xxxxxxxxxxxx
Subject: Re: [Ethereal-dev] Display filter as stop condition
On Fri, 24 Oct 2003 sford@xxxxxxxxxxxxx wrote:
> I've added a "Halt" feature to tethereal that uses a display filter as
> a stop condition. It is supplied as a string argument to "-H". It
> can be very useful for troubleshooting to see what led up to a
> particular condition (kindof like setting a breakpoint with an
> emulator). Combined with ring buffer, you can just start it, come
> back the next morning and have a good snapshot.
Cool! Someone asked about this at a talk I was giving on Tethereal this
morning; they'll be happy to hear about this.
BTW, why did you add another flag (-H) instead of adding another autostop
condition to "-a", e.g. "-a filter:xxxxx"?
_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev