Wireshark · Ethereal-dev: Re: [Ethereal-dev] Follow TCP Stream problem?

[Guy Harris <guy@xxxxxxxxxx>]

> I can get it to work both ways... 
> 
> 1) The correct way. 
> 
> Right click a packet with source address XXX.XXX.XXX.XXX
> and select the 'Follow TCP Stream' option.
> 
> 2) The wrong way.
> 
> Right click a packet with source address YYY.YYY.YYY.YYY
> and select the 'Follow TCP Stream' option.

"follow_read_stream()" appears to consider the "client" to be the
host/port from which the first packet in the stream is sent (which isn't
necessarily the case, of course, if you've caught the traffic in
mid-stream...).

However, "follow_stream_cb()", I suspect, considers the "client" to be
the host/port from which the *currently selected packet* is sent.  That
controls which of the last two two items in the option menu is
considered the "client" direction and which is considered the "server"
direction.

"follow_read_stream()"s choice is more likely to be correct than is
"follow_stream_cb()"s choice, so it shouldn't be changed.

Perhaps, instead, we need to have the callbacks for the option menu not
choose whether to show "client->server" or "server->client", but choose
one or the other address/port pairs as the source to show.