Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-users: RE: [Ethereal-users] Hex Dump w/ multiple packets in "Follow TCP Stream" window

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Roth, Kevin P." <KPRoth@xxxxxxxxxxxxxxx>
Date: Fri, 23 Aug 2002 15:32:37 -0400
OK, let's make this a feature request instead...  ;-)  I suppose
no-one will do such a thing, but it seems to me that the color coding
is enough of a differentiator that indenting shouldn't be necessary.
I notice that indenting is not used in the ascii and ebcdic modes...

If indenting must be used, could it be just a few columns instead
of 80? On Windows, there seems to be a limit to the amount a window
can be enlarged. Even if I drag it way off to the left, I can still
only drag it just so large before it won't let me make it any wider.
And the limit on my screen is just a few columns short of showing
everything without wrapping.

$0.02,
--Kevin



-----Original Message-----
From: Guy Harris [mailto:gharris@xxxxxxxxx]
Sent: Friday, August 23, 2002 3:26 PM

On Fri, Aug 23, 2002 at 02:44:24PM -0400, Roth, Kevin P. wrote:
> Don't know if this has been reported or not...  I'm using Ethereal
> 0.9.6 on Windows 2000 server.  If I do a "Follow TCP Stream" for a
> stream with two packets, and then click the "Hex Dump" button, I see the
> first packet dumped just fine, but the second packet's dump skips the
> first 76 columns,

In hex dump mode, data going in the other direction from the first byte
of the connection is indented so that it's entirely to the right of data
going in the same direction as the first byte of the connection; that's
what the "skipping" is doing.

Resize the window (standard left-button drag should do it).  The GTK+
1.x text widget, unfortunately, can't be told to add a scroll bar,
rather than wrapping lines, if the lines are too long.