ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] Taps should not use fd->flags.passed_dfilter (rtp, iax2, flo

From: Jakub Zawadzki <darkjames-ws@xxxxxxxxxxxx>
Date: Fri, 16 Aug 2013 08:01:37 +0200
On Fri, Aug 16, 2013 at 07:29:17AM +0200, Anders Broman wrote:
> Jakub Zawadzki skrev 2013-08-15 14:04:
> > Few GTK taps are using fd->flags.passed_dfilter as information whether
> > given packet is displayed, this is little broken and might not work as intended.
> >
> > [cut]
> >
> > but if you are doing some rtp analysis and do refiltering like:
> >    frame.number == 1
> >    ## nothing changes
> >
> >    frame.number == 2
> >    ## only frame #1 shows in stream analysis
> >
> >    frame
> >    ## only frame #2 shows in stream analysis
> >
> >    empty filter
> >    ## all frames from rtp stream shows up
> >
> >
> > I don't have any iax2 capture file but it's probably broken like above.
> >
> > Conversations tap and 'limit to display filter' is implemented properly (gratz!)
> > Attaching patch based on it.
> >
> > I'm not doing any rtp analysis, so please advice if it's proper way.
> > Thanks.
> >
> Looks correct to me :-)

What about:

> >    frame.number == 1
> >    ## nothing changes

It'll no longer work. Do we need 'limit to display filter' checkbox?