Ethereal-users: Re: [Ethereal-users] Colors in Merged traces

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Thu, 14 Oct 2004 14:51:58 -0700
Tom Thotus wrote:
When two traces (inside and outside of a firewall) are merged, they are both the same color. I see that there is a place to manage colors, but can't find a way to have the inside and outside traces be two different colors in the merged trace. This would greatly aid analyzing the traces together. Do you know of a way to do this

If you merge traces, packets are not tagged by the capture file they came from, so you can't do it based on that - the information as to which file the packet came from isn't available.

If, however, there's some other characteristic in the packet data itself, e.g. to or from addresses, it might be possible to use that.

or if the feature is planned for a future release?

The next generation of libpcap file format would allow packets to be tagged by the interface on which they're captured, and mergecap could preserve that tagging (although it might have to have an option to control what to do if the two captures have interfaces with the same name - should it default to assuming they're on different machines, and thus different interfaces, and add an option to cause them to be treated as the same interface?).

This isn't "planned" in the sense that it's scheduled for a particular release (we don't have any roadmaps with schedules), but it'll probably appear at some point after the new libpcap file format is finished (there's no roadmap for that, either).