Ethereal-users: Re: [Ethereal-users] See all Packets after "Follow TCP Stream"

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: "Martin Regner" <martin.regner@xxxxxxxxx>
Date: Sun, 28 Dec 2003 17:37:26 +0100
Planet99 wrote:
> I use the precompiled Ethereal (Version 0.10.0 for Windows) binaries with
> WinPcap 3.01 under
> Windows 2000 SP3.
>
> When I capture packets on the LAN and use "Follow TCP Stream" afterwards,
a
> new window with the
> content of the TCP-Transmission pops up.
> So far so good, but in the main window only the packets are displayed
which
> played a role in this
> particular transmission.
>
> How can I go back to see all captured packets?
>
> I've searched the handbook and there it says:
> "It is worthwhile noting that Follow TCP Stream installs a filter to
select
> all the packets on the TCP stream you have selected."
>
> But in the UI there is no indication for a filter, so that I could
> deactivate it.

The flter is in the bottom of the main Ethereal window and looks something
like "(ip.addr eq X.X.X.X and ip.addr eq X.X.X.X) and (tcp.port eq Y and
tcp.port eq Z)".

Just press the Reset button close to the filter string in the bottom of the
window and you the filter will be deactivated.