|From: Michael Tuexen | |Hi, | |I do understand the difference, I was more talking about |the way the user can handle this feature.
That's another story, with which I agree that we must make the feature as intuitive as possible to an end-user. |If I want to delete some packets I just mark them, |choose 'hide marked packets' an the remaining packets |are re-dissected. That's not true: *all* packets are being redissected, but the marked packets will not show up. That's different from really *ignoring* the packets flagged as deleted, so they don't influence dissection anymore. Consider the following packet capture: 1. WSP Connect 2. WSP Redirect to some nonstandard server socket 3. WTP Ack 4. WSP Disconnect 5. WSP Connect to the redirect address from packet 2 6. WSP ConnectReply 7. WTP Ack If I flag packet 2 as deleted, then a *new* redissection would not yield WSP-over-WTP dissection for packets 5--7 if the redirect address does not contain a standard WSP-over-WTP port. If I only flag the packet as marked, then it will still influence the dissection. Maybe we should not talk about "deleting" a packet, but rather: a. Remove packet [from dissection] b. Skip packet [dissection] c. Ignore packet [dissection] Regards, Olivier _______________________________________________ Ethereal-dev mailing list [EMAIL PROTECTED] http://www.ethereal.com/mailman/listinfo/ethereal-dev
