ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-dev: RE: [Ethereal-dev] Follow TCP Stream problem?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Jeff Foster <jfoste@xxxxxxxxxxxx>
Date: Tue, 9 Oct 2001 16:18:00 -0500
From: Guy Harris [mailto:guy@xxxxxxxxxx]
Sent: Tuesday, October 09, 2001 3:42 PM


> "follow_read_stream()" appears to consider the "client" to be the
> host/port from which the first packet in the stream is sent (which isn't
> necessarily the case, of course, if you've caught the traffic in
> mid-stream...).
> 
> However, "follow_stream_cb()", I suspect, considers the "client" to be
> the host/port from which the *currently selected packet* is sent.  That
> controls which of the last two two items in the option menu is
> considered the "client" direction and which is considered the "server"
> direction.
> 
> "follow_read_stream()"s choice is more likely to be correct than is
> "follow_stream_cb()"s choice, so it shouldn't be changed.
> 
> Perhaps, instead, we need to have the callbacks for the option menu not
> choose whether to show "client->server" or "server->client", but choose
> one or the other address/port pairs as the source to show.

I think the easy patch would be to add client address & port fields
to the follow_info_t struct. The follow_stream_cb could populate the
field and the follow_read_stream would use the fields instead of 
guessing based upon the first packet in the save file. 

The titles client/server in the code don't represent the actual
environment, but we don't show the names client/server in the GUI.
The naming problem in the code isn't important at this point and 
should be added to the 'gotta clean this when I get time' list.

Jeff Foster
jfoste@xxxxxxxxxxxx


***
The information in this e-mail is confidential and intended solely for the
individual or entity to whom it is addressed. If you have received this
e-mail in error please notify the sender by return e-mail, delete this
e-mail, and refrain from any disclosure or action based on the information.
****