Re: [Wireshark-dev] How can Wireshark improve

2014-04-25 Thread ronnie sahlberg
On Sat, Apr 19, 2014 at 12:48 PM, Guy Harris g...@alum.mit.edu wrote: On Apr 19, 2014, at 12:24 PM, Richard Sharpe realrichardsha...@gmail.com wrote: One think I would like to be able to do is Show me all the SMB2 requests where the smb2.flags.is_response == true smb2.nt_status !=

Re: [Wireshark-dev] How can Wireshark improve

2014-04-25 Thread Gerald Combs
On 4/25/14 10:02 AM, ronnie sahlberg wrote: Yes. I think in most cases you want to split packet relations up into two buckets : packets are related because they form a request/reply (and or cancel) pair and packets are related for some other reason. We could fix this by changing all

Re: [Wireshark-dev] How can Wireshark improve

2014-04-25 Thread Guy Harris
On Apr 25, 2014, at 10:02 AM, ronnie sahlberg ronniesahlb...@gmail.com wrote: Yes. I think in most cases you want to split packet relations up into two buckets : packets are related because they form a request/reply (and or cancel) pair and packets are related for some other reason. We

Re: [Wireshark-dev] How can Wireshark improve

2014-04-25 Thread Jeff Morriss
On 04/25/14 15:36, Guy Harris wrote: On Apr 25, 2014, at 10:02 AM, ronnie sahlberg ronniesahlb...@gmail.com wrote: Yes. I think in most cases you want to split packet relations up into two buckets : packets are related because they form a request/reply (and or cancel) pair and packets are

Re: [Wireshark-dev] How can Wireshark improve

2014-04-24 Thread Jaap Keuter
On 04/22/2014 05:15 PM, Jeff Morriss wrote: I really, really, *really* should take some time to clean up the wiki documentation of MATE and provide a lot more examples... Somehow I never find the motivation to tackle that beast... On a side note, should we aim for getting this stuff in

Re: [Wireshark-dev] How can Wireshark improve

2014-04-24 Thread Richard Sharpe
On Thu, Apr 24, 2014 at 10:12 PM, Jaap Keuter jaap.keu...@xs4all.nl wrote: On 04/22/2014 05:15 PM, Jeff Morriss wrote: I really, really, *really* should take some time to clean up the wiki documentation of MATE and provide a lot more examples... Somehow I never find the motivation to

Re: [Wireshark-dev] How can Wireshark improve

2014-04-22 Thread Jeff Morriss
On 04/19/14 15:48, Guy Harris wrote: On Apr 19, 2014, at 12:24 PM, Richard Sharpe realrichardsha...@gmail.com wrote: One think I would like to be able to do is Show me all the SMB2 requests where the smb2.flags.is_response == true smb2.nt_status != NT_STATUS_SUCCESS Presumably you mean

Re: [Wireshark-dev] How can Wireshark improve

2014-04-21 Thread Hadriel Kaplan
On Apr 19, 2014, at 3:48 PM, Guy Harris g...@alum.mit.edu wrote: So perhaps there should be a way to have a display filter show related packets in addition to packets that match the packet-matching expression. However, there are multiple flavors of related, and sometimes you might want

Re: [Wireshark-dev] How can Wireshark improve

2014-04-21 Thread Richard Sharpe
On Sat, Apr 19, 2014 at 12:48 PM, Guy Harris g...@alum.mit.edu wrote: On Apr 19, 2014, at 12:24 PM, Richard Sharpe realrichardsha...@gmail.com wrote: One think I would like to be able to do is Show me all the SMB2 requests where the smb2.flags.is_response == true smb2.nt_status !=

Re: [Wireshark-dev] How can Wireshark improve

2014-04-19 Thread Guy Harris
On Apr 19, 2014, at 12:24 PM, Richard Sharpe realrichardsha...@gmail.com wrote: One think I would like to be able to do is Show me all the SMB2 requests where the smb2.flags.is_response == true smb2.nt_status != NT_STATUS_SUCCESS Presumably you mean show me all the SMB2 transactions