From: "Ulf Lamping"
Sent: Monday, October 27, 2003 8:01 PM
Subject: Re: [Ethereal-dev] Display filter as stop condition
> > Date: Sat, 25 Oct 2003 07:56:48 +1000
> > From: "Ronnie Sahlberg"
> > While display filters are very powerful, they also require allk the
packets
> > to be fully disected.
> > This si slow and it also starts consuming more and more memory while
> > tethereal runs.
> >
> > On the other hand, capture filters does not require the packets to be
> > dissected, neither do they cause
> > the internal state in tethereal to start building up.
> >
> >
> > Therefore, so that it will be possible to capture at much higher speeds
and
> > for much longer intervals,
> > could you consider changing it to use capture filters instead of display
> > filters?
> IMHO: The best solution of using capture or display filters for this is to
be able to use both, and let the user decide which one to choose, as the
capture filters are much faster, but the display filters are much more
flexible, especially when you want to debug application protocol things.
You are right, it shoud be possible to use either a display filter or a
capture filter to specify the stop condition.
It would probably need to be implemented as two separate features internally
though since capture and display filters are managed
and evaluated in different parts of the code internally.
Display fitlers for those that want the flexibility ad dont have too high
demands on capture rates or durations
Capture filters for those that want to use it for longer duration and higher
speeds.
Preferably it should tie in with the options to control things like "stop
capture after..."
He was going to make a small change to the arguments used as suggested by
Gerald and resubmit it.
Hopefully it will go in soon so someone can enhance it to optionally take
capture filters as well.