["Stuart MacDonald" <stuartm@xxxxxxxxxxxxxxx>]

I notice that the filtering happens with a pattern like so:

(ip.addr eq A.B.C.D and ip.addr eq E.F.G.H) and (tcp.port eq X and tcp.port eq
Y)

Picture one very long (size- and time-wise) capture file. It's
possible that the above pattern could occur multiple times, especially
for a situation like a web server where one particular host is doing a
lot of requests.

1: It seems that the "follow" functionality is implemented somewhere
above the TCP dissector. Wouldn't it be better to have TCP do this?
This way sequence numbers could be double checked, and any additional
duplicate streams would be properly ignored.

2: Feature suggestion: have the "frame" protocol have room along with
the frame numbers to store tags. Once a stream has been identified the
frames that make it up could be tagged with a unique id, and then
filtering would be much simpler.

..Stu