On Sun, Feb 01, 2004 at 10:24:36AM -0500, Brady Volpe wrote: > Developing a generalized format in Ethereal that accepts one or more data > streams from either memory or the PCI bus would enable applications such as > DOCSIS sniffing to be more easily accomplished. The ideal situation would > be to use the existing ethereal display filters to function as capture > filters. In this case, WinPcap would be bypassed (or integrated) into > Ethereal.
I really do *NOT* want Ethereal to have any direct capture code. I think that belongs in libpcap, so that applications *other* than Ethereal can use it (I do *NOT* think Ethereal should be the one single application for all tasks that involve packet capture). Note also that Ethereal display filters are *not* cheap to implement - a fair bit of computation, and maintenance of state, is involved in doing full dissections, and a full dissection is necessary to implement display filters. The BPF capture filters that are used by libpcap are much cheaper. _______________________________________________ Ethereal-dev mailing list [EMAIL PROTECTED] http://www.ethereal.com/mailman/listinfo/ethereal-dev
