On Feb 4, 2004, at 12:02 PM, Greg Morris wrote:
Color filters are a great way for new users to be able to quickly go
through a trace to locate errors. I have a set of color filters that I
distribute to my users that flags retransmisssion, NCP, SMB, SRVLOC,
etc... error return values as Red.
Is that a "set of color filters", or a *single* color filter?
If it's a *single* color filter, perhaps the color filter list supplied
with Ethereal should have only one filter that checks for *all* errors
in *all* protocols.
The remaining color filters that I do is based on protocol so I color
TCP packets one color and DNS packets another. Much the way that
Sniffer
does so that it gives the user much the same look and feel. I think we
just need to come to an agreement as to what colors fit for what
protocols.
You're presuming that such an agreement would be possible; I don't know
that everybody wants the same color filters. (I would, personally,
uninstall any default color filter file installed on my machine - color
filters slow down capture loading, and, shocking as I suspect this
would be to many Ethereal users from what some users say, *I just don't
use color filters at all*.)
Perhaps if a site or organization wants to package a version of
Ethereal with a set of color filters useful in their environment, they
should do that; I'm not convinced that one can come up with a set of
color filters useful for everybody, other than, perhaps, a singleton
set with "mark errors in red" as the only such filter.
Display and Capture filters - Yes these are unique to your environment
I *didn't* make that argument about display and capture filters; that's
the one set of configuration files where I *don't* see an issue (other
than the lack of system-wide filter files) with supplying a default
file.