Wireshark · Ethereal-dev: [Ethereal-dev] Two ideas for new capabilities

[gregor.weiss@xxxxxxxx]

Hello.

I would like to suggest two new capabilities ethereal/tethereal should have:

1. When working in file-reading mode there is no need for using so much 
memory. I would suggest that in that mode the buffers could be deleted when 
they aren't used any more (they have been filtered and outputed) or at least 
truncated to a small size and with a file offset that would indicate where in 
the input file the packet can be re-read if needed.

2. There could be a way of saying something like that: Filter out only packets 
that produced a lot of network trafic for a specified timeblock. This would 
allow someone to simply log down all DDOS attacks to the disk (assuming he has 
a faster hard drive than network card - so that it can be written in time). 
The best would be if you could specify the size of the time interval that 
interests you and how many packets need to be sent in it that they are 
filtered out. For example more than 2000 packets in 1 minute would indicate 
strange activities in a not-actively used subnetwork that isn't capable of 
transfering large files.

I hope some of this will soon be added to tethereal.


       weiss

____________________
http://www.email.si/