From: "Ulf Lamping" Sent: Monday, October 27, 2003 8:01 PM Subject: Re: [Ethereal-dev] Display filter as stop condition
> > Date: Sat, 25 Oct 2003 07:56:48 +1000 > > From: "Ronnie Sahlberg" > > While display filters are very powerful, they also require allk the packets > > to be fully disected. > > This si slow and it also starts consuming more and more memory while > > tethereal runs. > > > > On the other hand, capture filters does not require the packets to be > > dissected, neither do they cause > > the internal state in tethereal to start building up. > > > > > > Therefore, so that it will be possible to capture at much higher speeds and > > for much longer intervals, > > could you consider changing it to use capture filters instead of display > > filters? > IMHO: The best solution of using capture or display filters for this is to be able to use both, and let the user decide which one to choose, as the capture filters are much faster, but the display filters are much more flexible, especially when you want to debug application protocol things. You are right, it shoud be possible to use either a display filter or a capture filter to specify the stop condition. It would probably need to be implemented as two separate features internally though since capture and display filters are managed and evaluated in different parts of the code internally. Display fitlers for those that want the flexibility ad dont have too high demands on capture rates or durations Capture filters for those that want to use it for longer duration and higher speeds. Preferably it should tie in with the options to control things like "stop capture after..." He was going to make a small change to the arguments used as suggested by Gerald and resubmit it. Hopefully it will go in soon so someone can enhance it to optionally take capture filters as well.
