Wireshark · Ethereal-dev: Re: [Ethereal-dev] Purpose of conversations ?

[Jeff Morriss <jeff_morriss@xxxxxxxxxxx>]

Michael Lum wrote:
> OK maybe I have misunderstood the purpose of conversations.
>
> I would like to string together packets containing SCCP Class 2 (connection
> oriented)
> messages.
>
> > From the display I would like to highlight a packet and then find
> all of the associated packets automatically.
>
> Is this what conversations are for?

My understanding is that conversations are used to store some data 
associated with a "conversation" so that subsequent messages in that 
conversation have that data associated with them.

For example, in SCCP Class 2 only the first couple of messages have 
Called and Calling party addresses.  Subsequent DATA messages only have 
SLR/DLR so using a display filter of "sccp.called.ssn == N" won't match 
them (the DATA messages).  If, however, those DATA mesages were part of 
a conversation _and_ the data stored for that conversation contained the 
Called party SSN then the above filter would work.