Wireshark · Ethereal-dev: [Ethereal-dev] [RFC] User-operated dissection

[Biot Olivier <Olivier.Biot@xxxxxxxxxxx>]

Hi list,

Sometimes we have a huge capture containing lots of packets from different
protocols and we want to generate a small capture file that shows a specific
issue. Very often we are tempted to either write a display filter or mark
interesting packets that will later be saved to a smaller capture file.

Eventually we reopen the smaller capture file and we realize that we cannot
dissect it anymore as some crucial packets have not been included in the
file.

I propose we add a new operation mode to Ethereal where we can
enable/disable packet dissection per packet, something similar to the
Mark/Unmark option we have.

This operation mode has the following benefits:
1. You can test the dissection based on the selected packets prior to saving
to a file
2. You can censure packets which fool your dissection, allowing to remove
"false errors"

Fire your remarks!

Regards,

Olivier