From: Richard Sharpe
| On Sat, 21 Feb 2004, Olivier Biot wrote:
|
| > | Hmmm, but perhaps what I could do is check if it is the proto
field,
| > and
| > | if so, simply return the value from that column ... that might
work.
| >
| > The proto column is not *the* protocol used, but *a* protocol
present
| > in the packet. There is no reference to the protocol which has set
the
| > column value, so it is not "possible" to build a display filter
based
| > on the proto column.
|
| Well, since the protocol column typically displays the bottom-level
| protocol, it seems to me that it would make most sense to simply
build a
| filter based on that.
As you state it, the word 'typically' is essential in this
description. As such, I fear the end-user will be confused when
right-clicking on the protocol column of the packet and seeing only
*a* protocol which maybe doesn't even match the desired/displayed
protocol. For instance, MIME media types will be the last protocols
found in an HTTP web browsing transaction, but the protocol column
will not be changed from HTTP (unless this is an MMSE transaction).
| Eg, if the protocol column currently displays SMB, and I right click
over
| that and select Match-->Selected, then I probably want to see only
SMB
| packets.
I agreee.
Maybe we want to add another "Match selected protocol..." context menu
in the summary view, which would expand to all protocols available in
the packet. Having such functionality in Ethereal would allow the
implementation of the "over" dislay filter operator, where one could
look for "mmse over http" or "mmse over wsp", or "tcp over ip" etc...
Regards,
Olivier