https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5279
--- Comment #12 from Chris Maynard <christopher.maynard@xxxxxxxxx> 2010-12-22 14:24:58 PST ---
(In reply to comment #11)
> Well, the whole point of ignoring packets is to prevent them from being
> dissected.
True.
But actually there are other display filters that will cause ignored packets to
still be displayed. Most (if not all?) would be due to the various frame.xyz
filters, and not necessarily just because of "frame.ignored==1". For example,
if a display filter of "frame.number < X" is applied and there are ignored
packets somewhere within frames 1-(X-1), then the ignored packets will still be
displayed. Or if you're looking at packets within a certain time interval, you
might use "frame.time_relative > X && frame.time_relative < Y", but if there
are ignored packets within that interval, then they'll still be displayed. You
can imagine other similar cases when applying other such frame filters
involving frame.length, frame contains, etc.
So it's not completely out of the question then that one might be interested in
only un-ignoring those frames that match those various frame filters in order
to find out what those particular frames are, but still leave any other ignored
packets as ignored. There's obviously a very small subset of the overall
display filters where ignored packets could still be displayed, so perhaps it's
not worth it. Or maybe it is?
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.