Ethereal-dev: Re: [Ethereal-dev] Saving all packets between the first and the last marked pack

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Ian Schorr <spamcontrol2@xxxxxxxxxxx>
Date: Thu, 25 Dec 2003 05:02:25 -0500

Maybe. But I know some Ethereal users capture huge amounts of packets, in
order to spot specific (sometimes periodic) errors which require the
end-user to process this data over and over, to follow a TCP stram and then
mark all filtered frames etc, to obtain a list of marked frames where you
*think* the problem occurs. Maybe there are erratic packets in between the
marked ones, which are relevant too. In this specific situation, the "XXX
between first and last marked packet" option really makes sense.

I suppose I could be one of those users, though I've never really thought about a need for "first and last marked packet" (I've always wanted to simply mark a range or specific set, either before or after applying a filter (such as following a stream)). Even in this case I can fairly easily find the first and/or last marked frames after-the-fact by "finding" frame.marked, though I understand that this is a potentially somewhat slower solution. I'm just not sure that the trade-off in UI complexity/intuitiveness is worth it. Like you said, though, it's all a matter of personal opinion.

Of course, the continuing performance enhancements should make reprocessing much faster anyway, yes? =)

Ian