Also try:
Statistics -> Conversation List -> TCP -> Right Click -> Display Filter ...
Analyze -> Follow TCP Stream
Edit -> Preferences -> TCP -> check all choices
Set display filter "tcp.analysis.flags"
For TCP, I find this to be equal or better than the Sniffer.
Wrolf Courtney
Donovan Data Systems, Inc.
(212) 633-5470
ethereal-users-bounces@xxxxxxxxxxxx wrote on 03/12/2004 12:02:32 PM:
> Thanks. I checked "Analyze TCP sequence numbers" and that did the trick.
>
> I have been using ethereal for about 5 months and had no
> idea this was available. I searched the doc high and low
> and found nothing.
>
> This seems like such a useful feature that maybe there should be some
> mention in
> the getting started guide. A new user might actually read that.
>
> Don't get me wrong I am grateful for this very useful tool.
>
> Bill
>
> Guy Harris wrote:
>
> > On Thu, Mar 11, 2004 at 08:07:53PM -0800, Bill Hecox wrote:
> > > Someone sent me a cap file today. We were reviewing the file
> > > and he said see the additional information in the info field.
> > >
> > > He had something like duplicate packet or similar info.
> > > I did not see this in my info field.
> > >
> > > Is there an expert mode similar to SNIFFER?
> >
> > No.
> >
> > The TCP dissector has *some* capabilities along those lines.
> >
> > > How do I activate this feature?
> >
> > You can activate the TCP feature by selecting "Preferences" from the
> > "Edit" menu, opening up the "Protocols" list in the Preferences dialog
> > box, selecting TCP, turning on "Analyze TCP sequence numbers", clicking
> > "Save" if you want that to be the default, and clicking "OK".
> >
> > That would detect TCP retransmissions, but it won't do anything for
> > other protocols.
>
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users