A lot of my logic usually just requires either a back button or just open in a new window and closing it when I don't see what I'm looking for. For our product and application behavior that we tend to look at, its either multiple tcp streams or within a stream, we look for either tcp.flags and/or application commands. All this analysis does effect how the pull down menu pops/pushes the first (high level) entry we initially apply if we're given only a single instance window.
Also, the pull down filter menu, it doesn't display really long filter expressions and multiple expressions tend to look alike (at least the first 100 characters or so). I have a pretty strong (or I'd like to believe) PC and figured something like this could be easily incorporated efficiently w/out having to re-read from the disk/share? Thanks, Alex Lee Riverbed Technology -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Stephen Fisher Sent: Thursday, June 28, 2007 10:59 AM To: Community support list for Wireshark Subject: Re: [Wireshark-users] Right-click and open a tcp stream in anew window? On Wed, Jun 27, 2007 at 10:31:57PM -0700, Alex Lee wrote: > I do a lot of these a lot for work: > > Tcp.flags.syn == 1 && tcp.flags.ack == && tcp.port == <some app> > > A lot of times I need to follow each new connection's stream but often > times, I end up not finding what I need in the first few streams. Is > it possible to add a right-click open-in-new-windows the "follow tcp > stream"? > > Or > > Add a "back" button to bring you back to the original filter string? Is the filter box drop-down list not helpful in this case? The previous filter string will be listed at the bottom of the list. Steve _______________________________________________ Wireshark-users mailing list [email protected] http://www.wireshark.org/mailman/listinfo/wireshark-users _______________________________________________ Wireshark-users mailing list [email protected] http://www.wireshark.org/mailman/listinfo/wireshark-users
