Re: Taps should not use fd->flags.passed_dfilter (rtp, iax2, flow_analysis)

[Jakub Zawadzki <darkjames-ws () darkjames pl>]

On Fri, Aug 16, 2013 at 07:29:17AM +0200, Anders Broman wrote:
> Jakub Zawadzki skrev 2013-08-15 14:04:
> > Few GTK taps are using fd->flags.passed_dfilter as information whether
> > given packet is displayed, this is little broken and might not work as intended.
> >
> > [cut]
> >
> > but if you are doing some rtp analysis and do refiltering like:
> >    frame.number == 1
> >    ## nothing changes
> >
> >    frame.number == 2
> >    ## only frame #1 shows in stream analysis
> >
> >    frame
> >    ## only frame #2 shows in stream analysis
> >
> >    empty filter
> >    ## all frames from rtp stream shows up
> >
> >
> > I don't have any iax2 capture file but it's probably broken like above.
> >
> > Conversations tap and 'limit to display filter' is implemented properly (gratz!)
> > Attaching patch based on it.
> >
> > I'm not doing any rtp analysis, so please advice if it's proper way.
> > Thanks.
> Looks correct to me :-)

What about:

> >    frame.number == 1
> >    ## nothing changes

It'll no longer work. Do we need 'limit to display filter' checkbox?
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe