Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Expert Info and display filters

From: Ulf Lamping <ulf.lamping@xxxxxx>
Date: Thu, 13 Sep 2007 01:48:31 +0200
Maynard, Chris schrieb:
Regarding the Expert Info, if you've applied a display filter then
select "Analyze -> Expert Info", the Expert Infos window contains ALL
Expert Info for all packets, even for packets that have been filtered
out due to the display filter.  I would have expected it to contain only
Expert Info pertaining to the filtered packets.  Is that by design or is
that a bug?
AFAIK, Yes and no - please correct my if I'm wrong with the following:

Expert info is using the tap mechanism which is designed to work with all packets. So it is "by design" as it's working like e.g. the Statistics stuff.

If this whole thing is "intelligent design" (sic) is a different question. I would also expect to see only the expert infos of the currently displayed packets - but that would be different than other alike functionality - and having some functions work on the displayed while other work on all packets is not a good idea.

Some statistic stuff is using what I would call a "pre-dialog", which let's you specify a display filter for the upcoming thing, but the usability of this is really odd ...

Regards, ULFL