Wireshark · Ethereal-dev: Re: [Ethereal-dev] Another new feature for Ethereal.

["Greg Morris" <GMORRIS@xxxxxxxxxx>]

Martin,

 

I hadn't thought of UDP. I typically work with TCP and IPX and just filter on MAC's to get what I need. This was to make it easier for my end users. I can see the benifit for UDP and it wouldn't take much work to add it. If and when it gets ported to CVS then I will look at adding UDP as well.

 

Greg

>>> <martin.regner@xxxxxxxxx> 8/6/2003 2:26:57 PM >>>

Greg Morris wrote:
> Many users of Sniffer like the Matrix option - Which allows you to see
> the conversations between different layers. I have been working on a new
> Tools Menu option called "Show Conversations". I know it is really not
> the correct technical term at each layer of the OSI but it should be
> close enough to allow users to identify it's purpose.
> 
> There are 4 options.
> 
> Conversations by MAC address - This is a table of the conversations
> between 2 unique MAC addresses.
> 
> Conversations by IP address - This is a table of the conversations
> between 2 unique IP addresses.
> 
> Conversations by TCP address - This is a table of the conversations
> between 2 unique IP/Ports.
> 
> Conversations by IPX address - This is a table of the conversations
> between 2 unique net/node/sockets.
> 


Looks very nice, but why not also UDP?
I'm using the "-z io,users,tcpip" and "-z io,users,udpip" a lot nowadays (tethereal only), and I have been thinking of trying to port it to Ethereal and add filtering buttons - but I had problems with understanding GTK.

Actually it could be good to see the "duration" (i�n seconds) of the conversion as well. I have planned to send i a patch to add some more stuff to the "-z io,users" output (First frame number, Last frame number, relative time of first packet and duration in seconds) that I found very useful when looking at certain problems.

Regards,
Martin