> >Ethereal needs some serious UI work, i.e. Following TCP flows seems to
> >have the nasty side effect of permanently(until reload) restricting the
> >visible packet stream.
>
> Go down to the bottom and clear out the filter field and hit enter.
Or, at least in the version in CVS, hit the "Reset" button at the bottom
- it's not entirely obvious that the way you clear a display filter is
to replace it with an empty string (meaning "show me all packets") and
then hit <Enter> to activate the new filter.
"Follow TCP Stream" sets the packet filter to show only packets in the
stream in question; perhaps "Follow TCP Stream" shouldn't do that, but
*something* should, as I've found that capability, in both Ethereal and
(a derivative of) "tcpview", *extremely* useful.
> >Also, you can't hit down arrow when focused on the packet heirarchy--it
> >just sscrolls down the raw data.
>
> Hmmm, yes, we are still working on the GUI :-)
GTK+ doesn't always do what you might want by default; this is one of
those cases. We'd have to work around the fact that the cursor arrows
don't change which item is selected in a columnar list (the topmost
pane) or a tree view (the middle pane); I think Nathan Neulinger sent
out mail on how to do that, although one person replied that he actually
preferred the current behavior in at least some circumstances (as I
remember, he liked to be able to scroll through the list of packets
while still keeping the originally-selected packet in the middle pane,
as he was looking for packets related to it in some fashion).
> >Finally, it crashes X *hard.* Kills my entire system. Not Good.
>
> This is news. Versions please? OS and Ethereal and GTK+.
...and X server as well. It could be (and probably is) that there's an
underlying bug in one of the aforementioned bits of software (my guess
would be the X server) that can be triggered by other applications as
well.
