Olivier Biot wrote:
Hi list,
Now that we don't put carriage returns in the display filter anymore,
the dialog for "Filter out this stream" doesn't show up anymore after
2 or 3 filtered-out streams (probably because the dialog becomes too
wide, however I see no error or warning message). Should we keep two
versions of the filter string for this peculiar situation (one for the
dialog, another for the display filter)?
I fear I might understand you incorrect.
Do you refer to the "Follow TCP stream" function?
Filtering out a TCP stream will only show *one* TCP stream (by TCP
design), or how do you filter out two streams or more in parallel?
Do mean filtering out *the same* TCP stream again and again? As this
might not be wise, it should work of course (and it seems to be a bug in
it).
The generated filter string (doing "follow TCP stream" on the same
packet twice) will look something like:
(ip.addr eq 10.0.0.10 and ip.addr eq 10.0.0.11) and (tcp.port eq 4517
and tcp.port eq 135) and !((ip.addr eq 10.0.0.10 and ip.addr eq
10.0.0.11) and (tcp.port eq 4517 and tcp.port eq 135))
As the second stream filter is appended using an exclamation mark, this
is logically a: "(stream a) and !(stream a)", which of course is wrong
and won't show any packets.
Could someone look at the "follow TCP stream" code and fix this?
Regards, ULFL