Wireshark-dev: Re: [Wireshark-dev] Automatic capture filters
From: Stephen Fisher <[email protected]>
Date: Mon, 28 Aug 2006 11:36:08 -0700
On Mon, Aug 28, 2006 at 10:58:37AM -0700, Guy Harris wrote:

> Do you mean "detect the X11 variables and skip the SSH variables if 
> the X11 variables are set", i.e. "check the X11 variables first rather 
> than checking the SSH variables first", for the "X11 one only" case, 
> and "detect all the variables" for the "(or both)" case?
> If so, is "block the X11 one only" the preferred solution, or is 
> "both" the preferred solution? 

I think the best solution is to block both the X11 traffic and the SSH 
traffic in this situation.  If it's too much trouble, checking the X11 
before SSH would be ok too.