ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] Wish: Mark/Find the element matching the display filter

From: Andrew Feren <acferen@xxxxxxxxx>
Date: Tue, 20 Nov 2007 09:55:57 -0800 (PST)
--- Guy Harris <guy@xxxxxxxxxxxx> wrote:

> Stephen Fisher wrote:
> 
> > My bad, it does work as I had intended.  It highlights the field (with
> > the function highlight_field()) whenever you do a hex or string search,
> > but not when you do a filter search.  Should we add filter search
> > matches too?
> 
> I'd say "yes" - if a search pattern of any sort matches a packet because 
> it matches a particular field in the packet, it should highlight the 
> matching field regardless of the type of the match.
> 
> That does raise an interesting question - if a pattern matches *more 
> than one* field in a packet, should "find next" find the next instance 
> that matches, even if it's in the same packet, or should it find the 
> next instance in that packet and, if there is no next instance in that 
> packet, search subsequent packets?  There are probably places where the 
> former is useful and places where the latter is useful.

Why not both?

Ctrl-N Find Next
Shift-Ctrl-N Find Next packet

Yea I know Shift-Ctrl-N is already used, but you get the idea.  (How about
Meta-Ctrl-N?  Is my emacs showing?  ;-)

-Andrew

-Andrew Feren
 acferen@xxxxxxxxx