Wireshark-dev: [Wireshark-dev] Conversation filters
From: "Kukosa, Tomas" <[email protected]>
Date: Wed, 21 Nov 2007 18:11:37 +0100
If I filter conversation from the context menu or the Conversations dialog it crates filter in following way (or similar):
ip.addr==ADDR1 and ip.addr=ADDR2 and tcp.port==PORT1 and tcp.port==PORT2
Unfortunaty it matches to two TCP streams ADDR1:PORT1<->ADDR2:PORT2 and ADDR1:PORT2<->ADDR2:PORT1
and if I have both of them in one file it is not easy to filter them from conversations menu.
Was it an intention or is it a bug?
If it is a bug what another filter style should we generate?