Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] Conversation filters

From: "Kukosa, Tomas" <tomas.kukosa@xxxxxxxxxxx>
Date: Wed, 21 Nov 2007 18:11:37 +0100
If I filter conversation from the context menu or the Conversations dialog it crates filter in following way (or similar):
ip.addr==ADDR1 and ip.addr=ADDR2 and tcp.port==PORT1 and tcp.port==PORT2
 
Unfortunaty it matches to two TCP streams ADDR1:PORT1<->ADDR2:PORT2 and ADDR1:PORT2<->ADDR2:PORT1
and if I have both of them in one file it is not easy to filter them from conversations menu.
 
Was it an intention or is it a bug?
 
If it is a bug what another filter style should we generate?
 
Regards,
  Tomas