Hi Guy.
> -----Original Message-----
> From: Guy Harris [mailto:gharris@xxxxxxxxxxxx]
> Sent: Thursday, December 07, 2000 20:26
> To: McNutt, Justin M.
> Cc: 'Fulvio Risso'; Visser, Martin (SNO); ethereal-users@xxxxxxxxxxxx
> Subject: Re: [Ethereal-users] Truly infinite capture
>
>
> ...
>
> Now, from the WinPcap documentation, it looks as if the statistics mode
> in WinPcap doesn't currently let you get statistics on the types of
> traffic going over the network; it provides periodic samples of the
> number of packets and the number of bytes that passed the capture
> filter, but you can have only one capture filter active at a time, so
> you can't get statistics on how many port-2049 (NFS) packets and bytes
> were seen, and how many port-80 (HTTP) packets and bytes were seen, and
> so on.
Yes, if you launches one monitoring at a time.
But you can launch more captures at the same time; the same you could do
with monitoring.
So you can have two threads at the same time, one that monitors "ip and port
80", the other "ip and poty 2049" and so on.
> I assume the ability to do that might be part of the "advanced monitor
> features" to which Fulvio is referring.
Yes.
We would like to create something that, with simple capture command, is able
to trace, for example, the protocol distribution without having to launch
several monitors at the same time.
Cheers,
fulvio