Wireshark · Ethereal-dev: Re: [Ethereal-dev] ERTSP: Ethereal's RemoTe Sniffing Protocol

["John McDermott" <jjm@xxxxxxxxxx>]

>> > The Idea is a protocol to have sniffing clients and a sniffing servers
>> > communicate. Part like RTSP, and part like RTP+RTCP with
>> > retransmissions.
>> This sounds really cool and well thought out.  Maybe I'm missing
>> something, though.  What about RMON? Yes, it has another filtering
>> language and yes, it is not "real time" in the sense that Ethereal is,
>> but
>> mightn't it be an appropriate solution?  Then, Ethereal could
>> inter-operate with existing probes and so forth.
>
> The point is to be able to use display filters on the remote probe
> before packets are transmitted.

Well, RMON does that, but it uses its own filtering language, and if we
want true Ethereal display filters, then, of course RMON is out (unless we
were to create a private filter MIB, I suppose...).  I just thought
interoperability might be useful.  I'm not convinced RMON is better than
your proposal, BTW, I just wanted to offer the thought.

We discussed this in 1999/2000 so you might want to check the archives for
that discussion, too.

--john