From: Richard Sharpe | On Sat, 21 Feb 2004, Olivier Biot wrote: | | > | Hmmm, but perhaps what I could do is check if it is the proto field, | > and | > | if so, simply return the value from that column ... that might work. | > | > The proto column is not *the* protocol used, but *a* protocol present | > in the packet. There is no reference to the protocol which has set the | > column value, so it is not "possible" to build a display filter based | > on the proto column. | | Well, since the protocol column typically displays the bottom-level | protocol, it seems to me that it would make most sense to simply build a | filter based on that.
As you state it, the word 'typically' is essential in this description. As such, I fear the end-user will be confused when right-clicking on the protocol column of the packet and seeing only *a* protocol which maybe doesn't even match the desired/displayed protocol. For instance, MIME media types will be the last protocols found in an HTTP web browsing transaction, but the protocol column will not be changed from HTTP (unless this is an MMSE transaction). | Eg, if the protocol column currently displays SMB, and I right click over | that and select Match-->Selected, then I probably want to see only SMB | packets. I agreee. Maybe we want to add another "Match selected protocol..." context menu in the summary view, which would expand to all protocols available in the packet. Having such functionality in Ethereal would allow the implementation of the "over" dislay filter operator, where one could look for "mmse over http" or "mmse over wsp", or "tcp over ip" etc... Regards, Olivier _______________________________________________ Ethereal-dev mailing list [EMAIL PROTECTED] http://www.ethereal.com/mailman/listinfo/ethereal-dev
